1.1. Document Structure and Reading Guidelines

This document attempts to give a comprehensive discussion of DSL. All aspects are hopefully addressed to one degree or another with what can be a complex topic since it deals with networking, hardware, new fangled technologies, and various approaches taken by various vendors.

To simplify the navigation of this document, below is a suggested reading guideline. Everyone should read the Introduction. Please pay special attention to the Conventions and Terminology section, as some of this terminology may be used somewhat differently in other contexts. Also, there is a Glossary if you get lost in the world of TA (telco acronyms) ;-).

• If you don't know anything about DSL, you should probably read the entire document, with the possible exception of the 'Tuning and Troubleshooting' section. You may want to start with the DSL Overview section in the Appendix, and then the FAQ. The DSL Overview explains how the various pieces of the puzzle fit together. DSL network implementations are more complex than traditional dialup networks.

• If you have already done some homework, but have not ordered service from anyone yet, read the Choosing Providers section, and the Linux Friendly ISPs sections. Also, you might get a head start by reading the Configuring Linux section so you know what lies ahead.

• If you have ordered service already, and are awaiting delivery, you can skip the sections on choosing a Provider. If you will be doing a self-install, you should read the pertinent parts of the Installation section, the Configuring Linux section, and the Securing Your Connection section.

• If the installation is complete, and you can't get a working connection, skip right to the Troubleshooting Section. If you are confused by what protocols are required, or what software you need to have installed, also read the Configuring Linux section. If not sure what terms like 'sync' mean in this context, then be sure to read the DSL Overview section first so you know how it all fits together.

• If trying to decide between cable and DSL, read the Cable vs DSL section, and possibly the DSL Overview section.

• There is a comprehensive Links section that has references to some topics not touched on in the main body of the Document itself.

1.2. Copyright

DSL HOWTO for Linux

Copyright (C)1998,1999 David Fannin.

This document is free; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This document is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You can get a copy of the GNU GPL at at GNU GPL.

1.3. Credits

Thanks to all those that contributed information to this HOWTO. I have anti-spammed their email addresses for their safety (and mine!). Remove the X's from their names.

• B Ediger (Xbediger@csn.net) Great Description of loop impairment.

• C Wiesner ( Xcraig@wkmn.com) List of many ADSL URLs.

• J Leeuw ( Xjacco2@dds.nl) Many tips on ADSL, especially in Europe

• N Silberstein ( Xnick@tpdinc.com) Info on Netrunner and his experience with US Worst.

• Many and various posters from comp.dcom.xdsl and bellsouth.net.support.adsl, too numerous to mention individually. (HB)

1.4. Disclaimer

The authors accept no liability for the contents of this document. Use the concepts, examples and other content at your own risk. As this is a new edition, there may be errors and inaccuracies. Hopefully these are few and far between. The author(s) do not accept any responsibility for incorrect or misleading information, and would certainly appreciate any corrections. Also, this type of technology dates itself very quickly. What may be true today, is not guaranteed to be true tomorrow.

All copyrights are held by their by their respective owners, unless specifically noted otherwise. Use of a term in this document should not be regarded as affecting the validity of any trademark or service mark.

The naming of any particular product, brand, or company should not be construed as an endorsement or recommendation.

1.5. New Versions

Version .99 addresses some of the many changes that have occurred since the original ADSL mini HOWTO was published. Originally, ADSL was the primary DSL technology being deployed, but more and more some of the other DSL flavors are entering the picture -- IDSL, SDSL, G.Lite, and RADSL. Thus the renaming from 'ADSL mini HOWTO' to the 'DSL HOWTO'. There have been many other changes in DSL technology as well. PPPoE/A encapsulation has become more and more common as many ISPs are jumping on this bandwagon.

The contents have additionally been re-organized, with new sections added on security, and troubleshooting, and as well as many additions to the Links section. Various and sundry other updates and additions as well that are too numerous to mention.

Pre-release versions of this document can be found at http://feenix.eyep.net/ldp/adsl/.

1.6. Feedback

Any and all comments on this document are most welcomed. Please make sure you have the most current version before submitting corrections! These can be sent to <hal@foobox.net>

Future versions of this document may include a section devoted to FAQs and HOWTOs for specific providers. Please send in any links you may have. Also, I need more Linux Friendly ISPs! See the Linux Friendly ISPs section for what qualifies.

1.7. Conventions, Usage and Terminology

For the sake of simplicity and sanity, let's clarify some of the terminology that we will be using in this document, so that we are all on the same page. While many of the definitions below are not always 100% technically correct, they are close enough for our purposes here. In fast moving technologies like DSL, there are so many 'ifs, ands, and buts' that it is difficult to say anything with any degree of certainty and have it stick. And there are exceptions to almost every rule. And sometimes exceptions to the exceptions. We will be dealing with generalities to a large degree here, please keep that in mind.

• 'DSL' will be used to refer to the entire family of DSL technologies now available -- ADSL, SDSL, IDSL, RADSL, etc. ADSL still seems to be the most prevalent at this time, but the others are being deployed more and more. Where it is important to differentiate one type of DSL from another, the full proper name will be used: e.g. RADSL. xDSL also is also commonly used to refer to the various DSL technologies as a group, but we will be using just 'DSL' here.

• The term 'telco' here refers to any potential DSL provider. This includes the ILECs (Incumbent Local Exchange Carriers), a.k.a. the old guard phone companies. And CLECs (Competitive Local Exchange Carriers), or independent providers such as Covad and Rhythms. Both are providing DSL services over existing copper lines.

• 'CO' is the telco acronym for 'Central Office'. Traditionally this is a building where one end of your phone line physically terminates. The other end terminates at your home, office, or wherever. It will be used here to refer to the telco end termination point, regardless of whether it is a traditional Central Office building or another, smaller, remote structure or device.

• 'Loop' is telco speak for 'phone line'. Essentially, you should think of your loop as one dedicated pair of copper wires that run uninterrupted from your residence or office directly to the CO. This is perhaps an oversimplification, but will serve our purposes. DSL availability, and signal quality, is tied directly to the characteristics of your physical line -- or 'loop' as they say.

• 'POTS' is the acronym for Plain Old Telephone Service. In other words, traditional, non-digital devices like phones and answering machines.

• 'DSLAM' is the sophisticated hardware device in the telco's CO where your phone line physically terminates, and thus makes DSL happen. Increasingly, telcos are making use of smaller devices like the 'mini-RAM' in remote locations. We'll use 'DSLAM' here as a catchall for any device that enables DSL service from a telco.

• 'Modem' will be used to refer to the end user device that enables a DSL connection. Your modem is connected to the telco's DSLAM in the CO via your loop. When they are 'talking' DSL to each other, they are in 'sync'. Without 'sync', no connection to the ISP is possible.

  'Modem' is indeed the correct terminology since there is MOdulation and DEModulation of the signal. These modems typically have other features too. Some ISPs and manufacturers may be marketing simply 'routers', 'bridges', or even 'brouters' for this purpose. These are essentially DSL modems with enhancements. A compatible 'modem' of some kind is the minimum hardware requirement at the customer's end of the connection. The most commonly supplied modem is actually a combination bridge and modem.

  Unless stated otherwise, we will also be assuming the 'modem' has an ethernet interface, and will connect to a standard Network Card (NIC). For right now, arguably the only workable configuration is an ethernet interface. And perhaps is also the only viable option based on what delivery systems and hardware are now being offered by the overwhelming number of providers. This could be changing soon however.

  It is worth noting that 'routers' as supplied by DSL providers are typically modem/router combination devices. In our context, 'router' will refer to these devices as such. There are also SOHO routers available that are only dedicated routers and lack the modem functionality.

• Previous versions of this document referred to the modem as an 'ANT' (ADSL Network Termination). While this may be technically correct terminology, it is not used by ISPs, manufacturers, telcos, or most users to any extent. The 'modem' will be just called a modem, regardless of whatever other features it may have (i.e. router, bridge, etc.).

• PPPoX will be used to refer to PPPoE (PPP over Ethernet) and PPPoA (PPP over ATM) collectively. These protocols are being used by many DSL providers now.

• The information provided in this document is based on the current state of DSL in the U.S. I would assume there are enough similarities with DSL services outside of the US that this document would still have some merit for everyone. Correct me if I am wrong by emailing <hal@foobox.net>

• A '#' will be used to denote a command that typically is run by the root user. Otherwise, a '$' will be used as the prompt for non-root users.

2.1. Pre-Installation

Beyond the obvious consideration of price, there are many reasons to investigate which providers may be offering DSL services in your area. The large Telephone companies are everywhere, and may advertise the most. But increasingly smaller ISPs and independents are getting into the act. This is creating diversity in the DSL marketplace. A good thing of course, but possibly creating a little confusion too.

Not all DSL services are alike. Just because two local companies are offering 'ADSL', does not mean that necessarily there is much in common at all. In fact, there are potentially a number of factors that make one ADSL provider's service significantly different from another's. Some things to consider:

• Speed vs Price.

• What hardware is provided, i.e. modem or router. Should be external ethernet in either case.

• The ISP's Network architecture. PPPoX? Static IP? Servers allowed?

• Is it an 'always on' service, at least theorectically? Are there supplemental usage fees, or idle timeouts?

• Linux friendly, Linux hostile, or Linux agnostic?

• Quality of service. How is news, mail, etc.?

For a more lengthy discussion on some of these considerations and related issues, see the DSL Overview appendix for more on modems, qualifying for service, and choosing a provider.

Once you have chosen a provider, and ordered service, the next step is for the telco to 'qualify' your loop. This essentially means testing your line to make sure it can handle the DSL signal, and possibly what level of service may be available to you. This may take some time, especially if the telco encounters problems with the loop. If no problems are found during this phase, then possibly there will be a two to three week wait for the installation.

After the telco has qualified the loop and readied their end of the connection, the next step is installation of the necessary components at the customer's end of the connection: wiring modifications, splitter or filters, and, of course the modem and any necessary software.

2.2. Installation Options -- Self Install or Not

You may or may not have a choice on how the installation is done, or who does it. This is totally at the discretion of the provider. Many providers offer a 'self install' option where you do all the work. In this scenario, the provider will send a kit in order to save them from sending a tech, and thus reducing cost. Typically, self install kits will include microfilters for the POTS (Plain Old Telephone Service) phone jacks, the modem (and maybe a NIC), and a CDROM with drivers, etc. on it. In some cases, a splitter may be included instead of microfilters.

The other possibility is for the provider to do the installation. Obviously, the cost is higher here, but it may have the advantage of having a trained tech do any wiring. There is also a better chance of getting a splittered installation with this option (a good thing!). Another benefit is that if something is wrong with the line, or the telco has not provisioned the line properly, an on-site tech may be able to help sort out some kinds of problems quickly.

The self-install kit should come with full instructions, regardless of whether the installation will be splittered or filtered. So we won't go into much detail on this aspect.

2.3. Wiring/Installation Options

There are various wiring schemes depending on how your service is being provided, who is providing it, and which DSL service is being provided.

• Dedicated Line. Some DSLs require a dedicated, or 'dry', wire pair, e.g. IDSL. This means a separate line for DSL and Internet connectivity. Also, DSL services from CLECs (independent telcos like Covad or Rhythms), will use a dedicated line since the ILEC will not share one line with another company. (Instead the CLEC will actually lease a loop from the ILEC.) One your end, this simply means using one of the unused wire pairs in the telco wire bundle, and connecting it to the DSL jack.

• Shared Line with Splitter. For DSLs, like ADSL, that are provided over the same line as regular voice service (POTS), the signal must be filtered somehow so that voice services are not adversely effected. Installing a splitter splits the line into two pairs, and filters the DSL signal from one of them. This results in a inside wiring scheme where DSL goes to only one jack, and then POTS service to all other jacks. This is considered by many to be a better type of installation than 'splitterless'.

  Splitters are available from various manufacturers and come in various shapes and sizes. Some are small enough to fit in the NID itself (sometimes called 'SNI', this is the telco phone box on the outside of your house), while others have a housing as large as the NID itself. Typically this is mounted near the NID, on the customer's side of the demarcation point.

• Shared Line with Filters. Again, for DSLs that piggyback on the POTS line, the signal must be filtered or split at some point. The other way of doing this is by placing RJ11 'microfilters' in each phone jack -- except where the DSL modem will be. These filters are relatively small, plug-in devices and remove the higher frequencies associated with DSL. This is obviously much easier since no tools or wiring is required. This is often what is included in self-install kits, and is often referred to as a 'splitterless' installation.

• Shared Line, Splitterless and Filterless. Newer DSLs, like G.Lite, have no adverse effect on regular POTS devices and thus require no filters or splitters. This would seem to be the wave of the future. Just plug and play.

Figure 1: DSL Block Diagram, POTS with Splitter (NID not shown)

       <--------Home/Office-----><---Loop---><--Central Office-->

 POTS  X-------+
 phone,        | 
 fax,          | 
 etc,          | 
               |                                 CO
               |                               -------
               |                               |     |
               |                               |     |
               |            -----              |     |
 POTS  X-------+----Voice--=| S |              |  D  |
                            | P |              |  S  |=- Voice Switch
                            | L |    2 wire    |  L  |
                            | I |=------------=|  A  |
                            | T |  Local Loop  |  M  |=- ISP --> INET
           ---------        | T |              |     |
 Linux X--=| Modem |=-Data-=| E |              |     |
           ---------        | R |              |     |
                            -----              |     |
                                               -------

    

Figure 2: DSL Splitterless (a.k.a. filtered) Block Diagram

       <--------Home/Office-------><----Loop---><--Central Office-->
                                      
 
 POTS  X--Voice---[RJ11]------+
 phone,          (filter)     | 
 fax,                         D                      CO
 etc,                         a                    -------
                              t                    |     |
                              a                    |     |
 POTS  X--Voice---[RJ11]----- &                    |  D  |
                 (filter)     V  -----             |  S  |=- Voice Switch
                              o  | N |   2 wire    |  L  |
                              i-=| I |=-----------=|  A  |
                              c  | D |  Local Loop |  M  |=- ISP --> INET
                              e  -----             |     |
           -----------        |                    |     |
 Linux X--=|  Modem  |=-------|                    |     |
           -----------                             -------
 
 
    

2.4. Self Install - Wiring

If you are not doing the self-install option, then you may skip this section and move to Configuring Linux. The following procedures are meant to illustrate the wiring process. Please note that your procedures may be different at your location. Make sure you follow any warnings or safety instructions provided, that you RTFM, and that you are familiar with telco wiring procedures.

The first step will be to wire up the connections from your provider. Identify the line on which service will be installed, and the locations of your splitter and DSL jack(s). (For perhaps a better wiring scheme, see the Homerun section immediately below.)

Be aware that typical telco wire has more than one pair per bundle. Often, two pairs, but sometimes more. If you have but one phone line, the other pair(s) are unused. This makes them available for use with wiring for DSL. Wire pairs are color coded for easy identification. SDSL and IDSL require a dedicated, or 'dry', pair. If an unused pair is available, then no real re-wiring is required. It is just a matter of re-wiring an existing jack for the correct pair of wires, and attaching the modem.

2.5. Wire the Splitter

If you have the splitterless design or a dedicated line, you may skip this part.

The splitter will typically consist of two parts, the splitter and a small outdoor housing. Mount the splitter and accompanying housing per the telco's instructions at the Subscriber Network Interface (SNI) point (also sometimes called the NID or ONI), usually the side of your house where the phone line is located. Put it on your side of the SNI or NID. The phone company may need to access the splitter for maintenance, so its advisable to locate it on the outside where they can get at it, but outside is not absolutely necessary.

The wire bundle should have at least two separate wire pairs. The splitter takes one pair, and separates the signal onto two pairs. One pair in the bundle will then go to all POTS jacks, and the other to the modem's DSL wall jack. So connect the incoming telco line to the LINE side of the splitter. Then wire the inside pair for your telephone to the VOICE, and your inside wire pair for the modem to DATA.

Checkstep At this point, you should be able to pull dial tone off the voice side of the splitter. If this doesn't work, then you've wired it wrong. You can also plug the modem into the test jack in the SNI/NID box (most should have this). Plug in the modem's power cord, and if the line is provisioned correctly, you should 'sync' in less than a minute. This test only requires the modem. (Internal and USB modems probably will require a driver to be loaded before syncing. This means having the computer there too.)

2.6. Wire the DSL Jack

Wire the DSL wall jack (RJ11) at your computer location, which should already be connected to the DATA side of the splitter. The specifics differ for each situation, but basically you will have a wire pair that you will connect to the DSL jack. Make sure you read the directions, as the DSL-RJ11 wiring may be different for phones and DSL jacks. AND -- different modems may expect the signal on different pairs -- most on the inside pair, but some on the outside pair.

Figure 3: RJ11 Wiring options

 
    ||
    ||
    ||
   /  \
  |RJ11|   
  |    |  
   ----
   ||||
   
    ^^  <-- Inside     Most modems on inside pair
   ^  ^ <-- Outside    Some on outside, e.g. Alcatel 1000, SpeedTouch Home

   

2.7. Install and Test the Modem

To install, connect the modem's (or modem/router's) power cord, and connect the phone line between the DSL wall jack and the modem. This cable should be provided. If not, a regular phone cord will suffice. With the ethernet interfaced modems, you may also connect the ethernet cable between the NIC and the modem (but not really necessary at this point just to verify the modem is working).

Checkstep At this point, verify the modem syncs with the telco's DSLAM signal. Most modems have a green LED that lights up when the signal is good, and red or orange if not in sync. The modem's manual will have more details on the LEDs. If it doesn't sync, then check your wiring, or make sure that the DSL signal is being sent. Do this by calling your telco and verifying they have activated the service. Or by testing the modem at the test jack on the SNI/NID (see above). Note that having dial tone on the line does NOT confirm the presence of the DSL data signal. And vice versa -- perfectly possible to have dial tone and no DSL, or DSL and no dial tone. There should also be no static or noise on the voice line when everything is installed and functioning properly.

2.8. Install and Connect the Network Card (NIC)

If you haven't already done so, install your NIC card in your Linux machine, configure the kernel, or load modules, etc., etc. This is sometimes the biggest stumbling block -- getting the NIC recognized and working. See the various Linux references for doing this, such as the Ethernet HOWTO for more information. Also, the Troubleshooting section. This is certainly something you could conceivably do ahead of time if you already have the NIC.

Be sure the RJ45 cable between the NIC and the modem is now connected. You can hot plug this cable.

We can do a few quick tests now to see if the NIC is functioning properly:

# ifconfig eth0 10.0.0.1 up


$ ping -c 50 10.0.0.1
PING 10.0.0.1 (10.0.0.1) from 10.0.0.1: 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=0 ttl=255 time=0.2 ms
64 bytes from 10.0.0.1: icmp_seq=1 ttl=255 time=0.2 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=255 time=0.1 ms
<snip>

- 10.0.0.1 ping statistics -
50 packets transmitted, 50 packets received, 0% packet loss
round-trip min/avg/max = 0.1/0.1/0.2 ms


$ ifconfig eth0
eth0    Link encap:Ethernet  HWaddr 00:50:04:C2:09:AC  
        inet addr:10.0.0.1  Bcast:10.255.255.255  Mask:255.0.0.0
        UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
        RX packets:428 errors:0 dropped:0 overruns:0 frame:0
        TX packets:421 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:100 
        Interrupt:10 Base address:0xc800 

If 'eth0' comes up without errors, and you can ping it without errors, and ifconfig shows no errors, we should have all our hardware in working order now, and are ready to start configuring Linux. If not, see the Troubleshooting section below.

Gotcha: A few modems may already be wired as a 10baseT crossover, and require a direct Category 5 cable for a direct connection to a NIC, rather than a crossover cable. I lost around 12 hours figuring this one out, so don't make the same mistake - make sure you RTFM first.

3.1. Bridged vs PPPoX Networks

Before we get too far into the final stages of installing and configuring our system, let's look at how various DSL ISPs set up their networks. It will be very important for you know how your ISP does this, as there is more than one possibility and the steps involved are quite different for each. This may not be the kind of thing the ISP is advertising, and since you are not using Windows, you may not have access to the setup disk that the ISP provides. If not sure, ask the ISP's tech support staff, or other users.

To muddy the waters even more, some ISPs may be offering more than one kind of service (over and above the various bit rate plans). Example: Bell Atlantic originally offered static IPs with a Bridged connection. Now all new installs use PPPoE with dynamic IPs. For installation and configuration purposes, this is very different.

The two most common DSL network implementations are Bridged/DHCP and PPPoX. Both have mechanisms for obtaining an IP address and other related networking configuration details so we shouldn't have to worry about this. Our job will be finding the right client, and doing what we have to, to get it up and running.

Important! You need to know beforehand how your ISP is setup for connecting to his network. To re-iterate, the two main possibilities are Bridged/DHCP and PPPoE. These are mutually exclusive implementations. So you will need either one or the other, and it must be the right one or you will waste a lot of time and effort. You cannot choose which one either. It is a matter of how the ISP is doing his network. Note that PPPoE can run over Bridged networks, so just knowing whether you are Bridged or not, is not necessarily good enough. PPPoA is yet another alternative. If your provider is giving you a router, there is a good chance that the router's firmware will handle all of this for you.

3.2. Configuring the WAN Interface

The most common configuration is a DSL modem in 'bridging' mode. Both PPPoE and DHCP can use this setup. In this scenario, the WAN interface typically means your NIC. This is where your system meets the outside world. (If you have a router see below for router specific instructions.) So essentially we will be configuring the NIC, typically 'eth0' since it is an ethernet interface.

With PPPoX, once the connection comes up, there will be a 'ppp0', or similar, interface, just like dialup. This will become the WAN interface once the connection to the PPP server is up, but for configuration purposes we will we be concerned with 'eth0' initially.

There are various ways an ISP may set up your IP connection:

• Static IP.

• Dynamic IP on Bridged Network via DHCP.

• Dynamic IP via PPPoX.

• Static IP via PPPoX.

Let's look at these individually.

 # ifconfig eth0 111.222.333.444 up netmask 255.255.255.0
 # route add default gw 111.222.333.1 dev eth0
 

$ route -n

Kernel IP routing table
Destination    Gateway      Genmask         Flags Metric Ref Use Iface
192.168.0.254  *            255.255.255.255 UH    0      0     0 eth1
208.61.124.1   *            255.255.255.255 UH    0      0     0 ppp0
192.168.0.0    *            255.255.255.0   U     0      0     0 eth1
127.0.0.0      *            255.0.0.0       U     0      0     0 lo
default        208.61.124.1 0.0.0.0         UG    0      0     0 ppp0


$ ifconfig
  
eth0    Link encap:Ethernet  HWaddr 00:A0:CC:33:74:EB
        UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
        RX packets:297581 errors:0 dropped:0 overruns:0 frame:0
        TX packets:266104 errors:1 dropped:0 overruns:0 carrier:2
        collisions:79 txqueuelen:100
        Interrupt:10 Base address:0x1300

eth1    Link encap:Ethernet  HWaddr 00:A0:CC:33:8E:84
        inet addr:192.168.0.254  Bcast:192.168.0.255  Mask:255.255.255.0
        UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
        RX packets:608075 errors:0 dropped:0 overruns:0 frame:0
        TX packets:578065 errors:0 dropped:0 overruns:0 carrier:0
        collisions:105408 txqueuelen:100
        Interrupt:9 Base address:0x1200

lo      Link encap:Local Loopback
        inet addr:127.0.0.1  Mask:255.0.0.0
        UP LOOPBACK RUNNING  MTU:3924  Metric:1
        RX packets:1855 errors:0 dropped:0 overruns:0 frame:0
        TX packets:1855 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:0

ppp0    Link encap:Point-to-Point Protocol
        inet addr:208.61.124.28  P-t-P:208.61.124.1  Mask:255.255.255.255
        UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
        RX packets:297579 errors:0 dropped:0 overruns:0 frame:0
        TX packets:266102 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:10

 # ifconfig eth0 10.0.0.2 up netmask 255.0.0.0
 # route add -net 10.0.0.0
 $ ping 10.0.0.1

3.3. Connect

Everything should be in place now. You probably have already tested your connection. You should be seeing ping roundtrip times of 10-40 ms to the ISP's gateway. If something has gone wrong, and you cannot connect, either retrace the above steps, or see the Troubleshooting Section below.

4.1. Security Quickstart

Before going on-line full-time, do not underestimate the need for securing your connection. You will have two things that mischief makers and crackers of the world are looking for: bandwidth, and a Unix-like OS. You instantly become an inviting target. And it is just a matter of time before someone comes knocking. Possibly a very short time. A quick start:

• Turn off any daemons and services that aren't absolutely essential, and can be accessed from outside. You can't get compromised through a port that isn't open. Use ps and netstat to see what services are running. (See man pages for specifics). Do you really need named, sendmail, telnet, ftp running and accessible to one and all? If not sure, then they should not be running. Then take whatever steps necessary to make sure they don't start again on the next boot. See your distribution's documentation on this.

  Many distributions start some well known services by default. You may not have done anything yourself explicitly to start these. And may not even realize these are indeed running. But it is up to you to know what is running, and how safe it is. Don't rely on a 'default' installation of any distribution to do this for you, or to be secure. Chances are it isn't.

• If you decide some services are essential, make sure you are running the most current version. Exploits are found, and then get fixed quickly. Don't get caught with your pants down. A full-time connection makes staying updated very easy -- and very important. Check with your distribution to see what new packages are available. And then stay in touch. If they have a security mailing list, get on it.

• Set up a firewall to limit access, and log connection attempts. This will be different depending on which kernel series you are using: ipfwadm for 2.0, ipchains for 2.2, and iptables for 2.4. See these HOWTOs for details:

• • Firewall HOWTO

  • Security HOWTO

  • IPCHAINS HOWTO

  • IP Masquerade HOWTO

  Additional references in the Links Section below.

• Take passwords seriously. Use shadow passwords. Do not allow remote root logins.

• Use ssh, or OpenSSH, instead of telnet.

4.2. Which Ports?

There are plenty of references around on how to setup firewalls with ipfwadm or ipchains, but a little harder to find just which ports really need to be open. If you are not sure of the answer to this question, then the answer is 'as few as possible'! Basic rule #1, your computer cannot be broken into through a port that is not open. And, a port can't be open if nothing is listening on that port. In other words, if no service or daemon is running that uses that port, the port is closed and inaccessible.

There are 65,536 ports available for use on Linux. These fall into several categories. The ones we are most concerned about are the 'privileged' ports, i.e. those below port 1024. This is where most public services run, like SMTP on port 25, HTTP on port 80, named on port 53, etc. These are where most vulnerabilities are on Linux. These are ports that servers accept outside connections on. If you are running the telnetd daemon, it will 'listen' for connections on port 23. (Actually if spawned by inetd, it may be inetd that is listening.)

But, if you want to use a telnet client to connect to someone else's telnet server, you do not need to be running the telnetd daemon on your own system. You just need to start the client program named 'telnet' (different animal). Same is true for ftp and other services. These daemons only need to be run for excepting connections to your system from an outside source.

Unless you have a good reason for doing so, and know what you are doing, then you should not be running these services. In fact, you could probably survive quite nicely with all TCP and UDP ports below 1024 closed down. Or, at least not visible to outside connections (i.e. blocked via a firewall). A couple of exceptions:

It is relatively safe, and probably reasonably safe, to run identd (port 113). Many mail and irc servers aren't happy without identd there. This is the one, good exception to the 'nothing below 1024' rule of thumb. Newer versions are relatively secure.

Mail is a little more complicated. The only reason to have a publicly accessible SMTP (port 25) server is if you are hosting your own mail server and receiving direct incoming mail connections. If you are retrieving mail via POP3 from your ISP, this port does not need to be open to the world. Such mail does not come in via port 25. It comes in through a higher, randomly assigned port.

But -- it may still be convenient to have a mail daemon like sendmail, qmail, or postfix running to handle local mail delivery. In fact, this is a common default set up. You can get around this by firewalling off SMTP (port 25) from the outside world, or using another method to sort and deliver local mail. One way is to use procmail in conjunction with fetchmail: 'fetchmail -m /usr/bin/procmail -d hal' will do this without having to run sendmail or other mail daemons in daemon mode. These programs are still capable of sending mail in non-daemon mode.

It is probably safe to run a web server if you want to. Most vulnerabilities there are through CGI. Just keep the web server package updated.

OK, enough exceptions. Shut down, or firewall off, everything else below port 1024.

Those ports above 1023 are known as 'non-privileged' ports. These are mostly used for return connections that you have initiated to someone else's server. For instance, if you telnet to someone else, you connect to their port 23. The return data comes back to you on a randomly assigned port above 1023. These are mostly safe, and in fact, should as a rule be left alone. The only exceptions are where there are indeed services running on these ports. X Windows runs on ports 6000-6009 for instance. If you are running a font server, it may be on port 7100. Any servers running on these non-privileged ports, should be firewalled too.

4.3. inetd

Let's take a quick look at inetd, since it starts many services. Inetd is a 'super' daemon. It is called this because it controls the starting of other daemons. Telnet, ftp, rsh, identd and pop3 are some of the server daemons commonly controlled by inetd. You may not see telnetd running when you use ps or netstat unless inetd is configured to start telnetd, and someone is actually connected to telnetd at the time. So it may not be so obvious which of these servers can be accessed from outside. These sub-services are controlled by the configuration file /etc/inetd.conf. Open this with your favorite text editor, and put a '#' character in front of any service you don't want running. A brief excerpt:

 
 #ftp    stream tcp nowait root /usr/sbin/tcpd in.wuftpd -l -a -L -i -o
 #telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd
 #
 # Shell, login, exec, comsat and talk are BSD protocols.
 #
 #shell stream  tcp     nowait  root    /usr/sbin/tcpd  in.rshd
 #login stream  tcp     nowait  root    /usr/sbin/tcpd  in.rlogind
 #exec  stream  tcp     nowait  root    /usr/sbin/tcpd  in.rexecd
 #comsat dgram  udp     wait    root    /usr/sbin/tcpd  in.comsat
 #talk   dgram  udp     wait    root    /usr/sbin/tcpd  in.talkd
 #ntalk  dgram  udp     wait    root    /usr/sbin/tcpd  in.ntalkd

   

This will prevent them from running. identd may be started from this file, and would be safe to leave uncommented. Then re-initialize: inetd:

 # kill -HUP `pidof inetd`

Note those are 'backquotes'. For more on fine tuning inetd access via 'tcpwrappers', see the hosts_access and tcpd man pages.

5.1. Installation Problems

Read this section, if you have no sync at all or are completely unable to connect. See your modem's owner's manual for interpreting the modem's LEDs. (Many will show a solid red (or orange) light if not in sync.)

5.2. Sync Problems

Read this section if you have had a working connection, but now have lost sync, or are intermittently losing sync, or your sync rate has dropped significantly, or are getting a 'sync/no surf' condition. (Better quality modems will have a way to report sync rate. Usually via telnet or a web browser interface. See the owner's manual.)

A loss of sync indicates a problem with the DSLAM, your line (inside or outside) or your modem. DSLAMs typically have 'shelves' with 'cards'. Alcatel DSLAM cards, just for instance, have a capacity of four connections each. If the card goes bad, at most four customers are effected. The point being that sync loss outages can be very isolated. Unlike network outages that tend to effect large numbers of users. Sync outages are also a telco problem, not an ISP problem. If your service agreement is with the ISP, you will need to contact them, who will in turn contact the telco.

Degraded sync rates, and disruption of the DSL signal, can cause various problems. Obviously, you will never get your maximum throughput under these conditions. But, the symptoms are not always obvious as to whether the problem is on your end or the provider's.

For instance, a poor inside wire connection may result in retransmissions of packets that have been lost, or dropped. This can really reduce throughput and slow a connection down. It is tempting to think of lost packets as a traditional networking problem, but with DSL it is possible to be the result of a bad line, impaired signal, or even the modem itself.

Some things to try:

• Power cycle the modem. Turn off the power button/switch, and physically unplug the cable to the wall jack for 30 seconds or so. Turn back on, and re-attach to wall jack. This will force a resync. Unfortunately, the only way to power down a PCI modem, is to reboot. This should fix a 'sync/no surf' condition that is caused by the modem, and maybe other conditions too.

• See the above section on moving the modem lock, stock and barrel to the NID/SNI and thus bypassing all inside wiring. If the situation is improved there, then the problem is inside somewhere. If not, it is a telco problem.

• RFI Bear-hunt: The DSL signal is fragile. A number of things can degrade it. RFI, or Radio Frequency Interference, from sources in and around the home/office is one common source of reduced signal strength, and/or intermittent sync loss and/or low sync rates. Our test tool here is simply a portable AM radio. Tune it to any channel where you can get clear reception -- makes no difference where. The AM radio will pick up RFI that is in the same frequency range as the DSL signal. It will sound like 'frying bacon' type static. Put against your computer's power supply. You should hear some static. Move it away and the static should fade pretty quickly. This will give you an idea of what RFI sounds like. A decent quality power supply should produce only weak RFI -- probably not enough to cause a problem. Use the radio like a Geiger counter and move it around your modem and DSL line. If you hear static, follow it to the source. Things to be suspicious of: power supplies, transformers, ballasts, electric motors, dimmer switches, high intensity lighting. Moving modem, or rerouting cables, is sometimes enough. Keeping the line between the modem and the wall jack as short as possible is a good idea too.

• Chronic sync problems are often due to a line problem somewhere. Sometimes it is something as simple as a bad splice, and easily remedied if it can be found. Most such conditions can be isolated by a good telco tech. Check with your provider, and politely harass if you have to. If you get the run-around, ask to go over their heads.

• If you are near the distance limits of DSL, and having off and on sync problems, try the 'homerun' installation. See above. This can be effective in improving marginal signal/sync conditions.

• If using a surge protector, try it without the surge protector. Some may interfere with the DSL signal.

Another possibility is a nearby AM radio station, or bandit ham radio operator that are disrupting the DSL signal since they operate in a similar frequency range. These may only cause problems at certain times of day, like when the station boosts its signal at night. A good telco DSL tech may be able to help minimize the impact of this. YMMV.

5.3. Network and Throughput Problems

Read this section if your connection is up, but are having throughput problems. In other words, your speed isn't what it should be based on your bit rate plan, and your distance from the CO. 'Network' here is the WAN -- the ISP's gateway and local subnet/backbone, etc. Remember too that a marginal line can cause a reduced sync rate, and this will impact throughput. See above.

The two factors we will be looking for are 'latency' and 'packet loss'. Both are pretty easy to track down with the standard networking tools ping and traceroute. If either of these occur in our path, they will impact performance. Latency means 'responsiveness' or 'lag time'. Actually what we are interested in is abnormally high latency, since there is always some latency. Packet loss is when a packet of data gets dropped somewhere along the way. TCP/IP will know it's been 'lost', and there will be a retransmission of the lost data. Enough of this can really slow things down. Ideally packet loss should be 0%.

Also, what we really need to be concerned about, is that part of the WAN route that we routinely traverse. If you do a traceroute to several different sites, you will probably see that the first few 'hops' tend to be the same. These are your ISP's local backbone, and your ISP's upstream provider's gateway. Any problem with any of this, and it will effect everywhere you go, and everything you do.

We can start looking for packet loss and latency by pinging two or three different sites, hopefully in at least a couple of different directions. We will be looking for packet loss and/or unusually high latency.

 $ ping -c 12 -n www.linuxdoc.org
 PING www.linuxdoc.org (152.19.254.81) : 56(84) bytes of data.
 64 bytes from 152.19.254.81: icmp_seq=0 ttl=242 time=62.1 ms
 64 bytes from 152.19.254.81: icmp_seq=1 ttl=242 time=60.8 ms
 64 bytes from 152.19.254.81: icmp_seq=2 ttl=242 time=59.9 ms
 64 bytes from 152.19.254.81: icmp_seq=3 ttl=242 time=61.8 ms
 64 bytes from 152.19.254.81: icmp_seq=4 ttl=242 time=64.1 ms
 64 bytes from 152.19.254.81: icmp_seq=5 ttl=242 time=62.8 ms
 64 bytes from 152.19.254.81: icmp_seq=6 ttl=242 time=62.6 ms
 64 bytes from 152.19.254.81: icmp_seq=7 ttl=242 time=60.3 ms
 64 bytes from 152.19.254.81: icmp_seq=8 ttl=242 time=61.1 ms
 64 bytes from 152.19.254.81: icmp_seq=9 ttl=242 time=60.9 ms
 64 bytes from 152.19.254.81: icmp_seq=10 ttl=242 time=62.4 ms
 64 bytes from 152.19.254.81: icmp_seq=11 ttl=242 time=63.0 ms
 
 --- www.linuxdoc.org ping statistics ---
 12 packets transmitted, 12 packets received, 0% packet loss
 round-trip min/avg/max = 59.9/61.8/64.1 ms

The above example is pretty normal from here. (You probably have a very different route to this site, and your results may thus be quite different.) Apparently no serious underlying problems that would slow me down. The below example reveals a problem:

 $ ping -c 20 -n www.debian.org
 
 PING www.debian.org (198.186.203.20) : 56(84) bytes of data.
 64 bytes from 198.186.203.20: icmp_seq=0 ttl=241 time=404.9 ms
 64 bytes from 198.186.203.20: icmp_seq=1 ttl=241 time=394.9 ms
 64 bytes from 198.186.203.20: icmp_seq=2 ttl=241 time=402.1 ms
 64 bytes from 198.186.203.20: icmp_seq=4 ttl=241 time=2870.3 ms
 64 bytes from 198.186.203.20: icmp_seq=7 ttl=241 time=126.9 ms
 64 bytes from 198.186.203.20: icmp_seq=12 ttl=241 time=88.3 ms
 64 bytes from 198.186.203.20: icmp_seq=13 ttl=241 time=87.9 ms
 64 bytes from 198.186.203.20: icmp_seq=14 ttl=241 time=87.7 ms
 64 bytes from 198.186.203.20: icmp_seq=15 ttl=241 time=85.0 ms
 64 bytes from 198.186.203.20: icmp_seq=16 ttl=241 time=84.5 ms
 64 bytes from 198.186.203.20: icmp_seq=17 ttl=241 time=90.7 ms
 64 bytes from 198.186.203.20: icmp_seq=18 ttl=241 time=87.3 ms
 64 bytes from 198.186.203.20: icmp_seq=19 ttl=241 time=87.6 ms
 
 --- www.debian.org ping statistics ---
 20 packets transmitted, 13 packets received, 35% packet loss
 round-trip min/avg/max = 84.5/376.7/2870.3 ms

High packet loss at 35%, and some really slow roundtrip times in there as well. A little digging on this showed that it was a backbone router 13 hops into the traceroute that was the problem. While making this site really slow from here, it would only effect those routes that happen to hit that same router. Now what would really hurt us is if something similar happens with a router that we tend to go through consistently. Like our gateway, or maybe the second hop router too. Find these with traceroute, by just picking a random site:

 $ traceroute www.bellsouth.net
 
 traceroute to bellsouth.net (192.223.22.134), 30 hops max, 38 byte packets
  1  adsl-78-196-1.sdf.bellsouth.net (216.78.196.1)  14.86ms  7.96ms 12.59ms
  2  205.152.133.65 (205.152.133.65)                  7.90ms  8.12ms  7.73ms
  3  205.152.133.248 (205.152.133.248)                8.99ms  8.52ms  8.17ms
  4  Hssi4-1-0.GW1.IND1.ALTER.NET (157.130.100.153)  11.36ms 11.48ms 11.72ms
  5  125.ATM3-0.XR2.CHI4.ALTER.NET (146.188.208.106) 14.46ms 14.23ms 14.40ms
  6  194.at-1-0-0.TR2.CHI2.ALTER.NET (152.63.65.66)  16.48ms 15.69ms 16.37ms
  7  126.at-5-1-0.TR2.ATL5.ALTER.NET (152.63.0.213)  65.66ms 66.18ms 66.39ms
  8  296.ATM6-0.XR2.ATL1.ALTER.NET (152.63.81.37)    66.86ms 66.42ms 66.40ms
  9  194.ATM8-0.GW1.ATL3.ALTER.NET (146.188.233.53)  67.87ms 68.69ms 69.63ms
 10  IMVI-gw.customer.ALTER.NET (157.130.69.202)     69.88ms 69.25ms 69.35ms
 11  www.bellsouth.net (192.223.22.134)              68.74ms 69.06ms 68.05ms

The first hop is the gateway. In fact, for me the first two hops are always the same, and the first three or four are often the same. So a problem with any of these, may cause a problem anywhere I go. (The specifics of your own situation may be a little different than this example.) A 'normal' gateway ping (for me!):

 
 $ ping -c 12 -n 216.78.196.1
 
 PING 216.78.196.1 (216.78.196.1) : 56(84) bytes of data.
 64 bytes from 216.78.196.1: icmp_seq=0 ttl=64 time=14.6 ms
 64 bytes from 216.78.196.1: icmp_seq=1 ttl=64 time=15.4 ms
 64 bytes from 216.78.196.1: icmp_seq=2 ttl=64 time=15.0 ms
 64 bytes from 216.78.196.1: icmp_seq=3 ttl=64 time=15.2 ms
 64 bytes from 216.78.196.1: icmp_seq=4 ttl=64 time=14.9 ms
 64 bytes from 216.78.196.1: icmp_seq=5 ttl=64 time=15.3 ms
 64 bytes from 216.78.196.1: icmp_seq=6 ttl=64 time=15.4 ms
 64 bytes from 216.78.196.1: icmp_seq=7 ttl=64 time=15.0 ms
 64 bytes from 216.78.196.1: icmp_seq=8 ttl=64 time=14.7 ms
 64 bytes from 216.78.196.1: icmp_seq=9 ttl=64 time=14.9 ms
 64 bytes from 216.78.196.1: icmp_seq=10 ttl=64 time=16.2 ms
 64 bytes from 216.78.196.1: icmp_seq=11 ttl=64 time=14.8 ms

 --- 216.78.196.1 ping statistics ---
 12 packets transmitted, 12 packets received, 0% packet loss
 round-trip min/avg/max = 14.6/15.1/16.2 ms

And a problem with the same gateway on a different day:

 $ ping  -c 12 -n 216.78.196.1
 
 PING 216.78.196.1 (216.78.196.1) : 56(84) bytes of data.
 64 bytes from 216.78.196.1: icmp_seq=0 ttl=64 time=20.5 ms
 64 bytes from 216.78.196.1: icmp_seq=3 ttl=64 time=22.0 ms
 64 bytes from 216.78.196.1: icmp_seq=4 ttl=64 time=21.8 ms
 64 bytes from 216.78.196.1: icmp_seq=6 ttl=64 time=32.0 ms
 64 bytes from 216.78.196.1: icmp_seq=8 ttl=64 time=21.7 ms
 64 bytes from 216.78.196.1: icmp_seq=9 ttl=64 time=42.0 ms
 64 bytes from 216.78.196.1: icmp_seq=10 ttl=64 time=26.8 ms
 
 --- adsl-78-196-1.sdf.bellsouth.net ping statistics ---
 12 packets transmitted, 7 packets received, 41% packet loss
 round-trip min/avg/max = 20.5/25.6/42.0 ms

41% packet loss is very high. To the point where many services, like HTTP, come to a screeching halt. Those services that were working, were working very, very slowly.

It's a little tempting on this last real-life example to think this gateway router is acting up. But, as it turned out, this was the result of a problem in the DSLAM/ATM segment of the telco's network. So any first hop problem with packet loss or high latency, may actually be the result of something occurring before the first hop. But we just don't have the tools to isolate where it is starting well enough. Packet loss can be a telco problem, just as much as an ISP/NSP problem.

It is also quite possible for the modem itself to cause packet loss. The fix here is to power cycle the modem, and resync by unplugging the DSL connection for 30 seconds or so. In fact, any part of the connection can be a source of packet loss -- modem, DSLAM, ATM network, etc.

If you do find a problem within your ISP's network, it's time to report the problem to tech support.

5.4. Measuring Throughput

No such thing as too fast, right? One of the first things most of us do is check our speeds to make sure we aren't getting short changed, and that our system is up to snuff. Doing this accurately is easier said than done however. First, remember you are losing 10-20% right off the top due to networking overhead. Just how much is 'lost' here depends on your provider's network architecture and other considerations.

Then, any time you hit the Internet, there is some slight degradation of performance with each hop you take. Now this may not amount to much, as long as you are not taking too many hops and all the components -- your system, your ISP's network, your ISP's upstream provider, and the destination itself -- are all working like well oiled machines. But there's the rub -- how do you really know with so many variables in the mix? One flaky interface, on one router, on one hop along the path, may cause misleading results.

Your absolute max speed is going to be at your point of connection to your ISP -- the ISP's gateway. It can only go downhill from there, not up! So the ideal test is as close to home as possible. This eliminates as many unknown variables as possible. If your ISP has a local ftp server, this is an excellent place to run your own tests. (Run a traceroute though just to see how local it really is.)

If your ISP does not have this, look for an ftp site that is close -- the fewer the hops, the better. And look for one that isn't too busy, or you will get misleading results. Find a large file -- like 10 Megs -- and time the download. Try this over several days, and at different times of day. The server, and the backbone, are going to be busier at certain times of day, which can skew results and you want to eliminate these variables as much as possible. Your provider cannot compensate for heavy backbone traffic, backbone bottlenecks, slow or busy servers, etc.

There are many test sites scattered around the web. Some are better than others, but take these with a grain of salt. There are just too many variables for these tests to reliably give you an accurate snapshot of your connection and throughput. They may give you a general picture of whether you are in the ballpark of where you think you should be or not. One good speed test is http://www.dslreports.com/stest/0. Another test is http://speedtest.mybc.com/ (both are java). I find these to be better than some of the others out there.

Now keeping in mind that we are limited by the ~10-20% networking overhead rule, here is an example. My speed is capped at 1472 Kbps. Minus the ~15% is 1275 Kbps. My sync rate is known to be good and my distance to the CO is about 9000 Ft, which is close enough that I should be able to hit my real world maximum throughput of 1275 Kbps or roughly 1.2-1.3 Mbps -- all other things being equal. From dslreports.com speed test:

 Test running..Downloaded 60900bytes in 5918ms
 Downloaded 696000bytes in 4914ms
 First guess is 1133kbps
 fairly fast line - now test 2mb
 Downloaded 1679100bytes in 11090ms
 Upload got ok 1 bytes uploaded
 Uploaded 1bytes in 211ms
 Upload got ok 1 bytes uploaded
 Uploaded 1bytes in 205ms
 Upload got ok 1 bytes uploaded
 Uploaded 1bytes in 207ms
 Upload got ok 50000 bytes uploaded
 Uploaded 50000bytes in 2065ms
 Upload got ok 100000 bytes uploaded
 Uploaded 100000bytes in 3911ms
 
 ** Speed 1211(down)/215(up) kbps **
 (At least 24 times faster than a 56k modem)
 Finish.

1.211 Mbps is probably about as good as I can realistically expect based on my service. There is no reason for me to go troubleshooting or looking for tweaks.

Big Caution: my ISP uses a caching proxy server for web pages. This is a big equalizer for these kinds of web based tests. Without that, I surely would have been significantly slower on this test. The effect of the proxy is that you are actually testing throughput from the proxy -- NOT the test site. Just FYI. Another note: at the same time I tried another test site and was consistently getting 600-700 Kbps. So YMMV with these tests. (Usually I get the same on each, more or less.) Timing a large ftp download, I calculated about 1.25 Mbps.

6.1. The DSL Family

• ADSL

  Asymmetric Digital Subscriber Loop. This DSL type currently supports downstream rates up to 8 Mbps, and upstream of 1024 Kbps, hence the 'asymmetric'. The most widely deployed form of DSL at this time, and was specifically developed for the home and SOHO markets. The higher downstream rates lends itself to those not running serious servers -- at least anything more than a small, personal web site. ADSL is capable of sharing data with a POTS voice line, so an additional line is not required. A big selling point. ADSL, like other DSLs, is limited by distance. 18,000 ft (5.5 km) is a typical cut-off point for telcos. ADSL does typically require either a splitter or filters to isolate the DSL signal from POTS. Sometimes referred to as 'full rate' ADSL in order to differentiate it from G.Lite DSL. There are two common line encodings for ADSL: DMT and CAP. DMT (a.k.a. Alcatel compatible) has won the standards battle and is now the more common of the two. Also, note that modems must be compatible with the encoding. In other words, a CAP modem will not work with a DMT service, and vice versa.

• G.Lite

  Sometimes called 'DSL Lite', 'Universal DSL' or 'splitterless ADSL', is a slower version of ADSL that require no splitters or filters. The isolation of voice and data signals is handled at the CO. Currently G.Lite supports speeds up to 1.5 Mbps/512 Kbps, and is expected to eventually become the dominant consumer DSL service. As of this writing, it is not as wide spread as 'full rate' ADSL however.

• SDSL

  Single-pair Digital Subscriber Loop, or also sometimes referred to as 'Symmetric Digital Subscriber Loop' since it is indeed symmetric with a current maximum rate of 1.5 Mbps/1.5 Mbps. SDSL requires a dedicated line, and thus true SDSL is not as readily adaptable to the consumer market as ADSL. SDSL also uses a 2B1Q encoding (same as ISDN and some T1) which is considered more robust than the DMT or CAP encoding of ADSL. True SDSL is generally considered more of a server quality DSL. It is worth noting that some providers may be marketing a 'SDSL' service that is really ADSL pinched so that upstream/downstream are the same. Wasn't all this confusing enough already?

• IDSL

  ISDN Digital Subscriber Loop, 144 Kbps/144 Kbps is really a new and improved ISDN from Lucent Technologies and uses the same 2B1Q line encoding as ISDN, SDSL and others. IDSL does require a dedicated line however. The benefits are that it is an 'always on' technology, like other DSLs, and provides an additional 16 Kbps over traditional ISDN. It is being marketed by some DSL providers as a low end bit rate option, where line quality is not sufficient for higher speeds such as that of ADSL.

• RADSL

  Rate Adaptive Digital Subscriber Loop was developed by Westell and has a potential of 2.2 Mbps downstream and 1.0 Mbps upstream. What makes RADSL more flexible is that the sync rate can be dynamically adjusted up or down as line conditions change. This makes it more of a viable alternative where line conditions are marginal. In many respects, RADSL is an enhanced ADSL to meet a more diverse set of line conditions. Like ADSL, RADSL can piggyback on the POTS line.

• HDSL

  High bit-rate DSL was one of earliest versions of DSL. HDSL requires multiple, dedicated wire pairs, and is symmetric at 1.5 Mbps/1.5 Mbps (actually depends on number of wire pairs used). Not a viable alternative for the consumer or SOHO markets.

• VDSL

  Very high rate Digital Subscriber Loop, a DSL still in development with a current downstream capacity of 52.8 Mbps, and upstream of 2.3 Mbps. At this time, VDSL is limited to very short loop lengths, and is not a viable alternative (yet). It may find application where there is fiber to the neighborhood, and thus the copper loop segment is relatively short.

• UDSL

  Unidirectional Digital Subscriber Loop is a proposal from Europe that is not yet in use.

• G.SHDSL

  Standards not finalized yet. Supposedly includes many enhancements.

6.2. The DSLAM

This technology is made possible by the placement of DSLAMs, or Digital Subscriber Loop Access Multiplexers, from such suppliers as Alcatel and Cisco, in the telco's Central Office. DSLAMs come in various shapes and sizes, and are the one, single complex and costly component of a DSL connection. When a qualified phone line is connected to a modem at the user's end of the loop, a high speed digital connection is established, typically over ATM, or sometimes frame relay. The DSLAM splits the signal back into separate voice and data channels. The voice channel stays within the telco network, whereas the data is picked up by an ISP.

Figure 4: A Typical DSL Connection Path

 Voice -+                                               +---> Voice 
        |<-- copper loop --> DSLAM/CO <--{ATM cloud}--->|
 modem -+                       |                       +---> Inet
        |                       |                       |
 ether..|..... DSL/ATM here ....|.... raw ATM here .....|.. TCP/IP ..
        |                                               |
 SOHO...|............ telco (ILEC or CLEC) .............|.. ISP ..| NSP
 
   

 Command-> show dslstatus

 --- Channel Info               ATU-R                    ATU-C
  Current TX Rate  -           384000                  1500000
  Previous TX Rate -                0                        0
  CRC Block Length -                -                        -
  Interleave Delay -                -                        -
 
 --- Physical Layer Info        ATU-R                    ATU-C
  Current Attainable Rate -    448433                  3890243
  Current SNR Margin      -      10.5                     17.0
  Current Attenuation     -      54.5                     31.5
  Current Output Power    -       3.0                     16.0
  Current Status:
   Defects detected       -        No                       No
   Loss of Framing        -   No Loss                  No Loss
   Loss of Signal         -   No Loss                  No Loss
   Loss of Power          -   No Loss                  No Loss
   Loss of Signal Quality -   No Loss                  No Loss

 --- ATU-R Line Status
  Line Coding - DMT
  Line Type   - Fast or Interleaved

 Command->

6.3. DSL Modems

The modem is the last piece of the connection. The modem is connected directly to the DSLAM via the copper loop on the telco end, and plugs into a wall jack on your end. When all is well, the modem 'syncs' with the DSLAM, and then makes an IP connection to the ISP. And off we go!

For Linux users, the modem is a very important consideration! You will need an external, ethernet interfaced modem (or modem/router combo) that connects via a standard NIC, since virtually all other modem options (PCI, USB, onboard) will not work due to a lack of drivers at this time! All ethernet based modems will work fine.

The only potential compatibility issue is the Network Card (NIC). (And really any compatible ethernet NIC should do just fine -- 100 Mbps is not necessary.) You are probably better off anyway, since PCI and USB modems are more problem prone. If your chosen provider does not offer a compatible modem as an option, then you either need to look elsewhere, or you will have to buy one outright from a third party.

As always there are exceptions. Diamond makes an internal PCI modem which has binary-only drivers, and is not in widespread use. Efficient Networks is beta testing Linux drivers for their SpeedStream 3060 and 3061 PCI modems, and is expected to be released 'any day'. At this time, this will require a 2.4.x kernel, and a patch as well for the necessary ATM support. Efficient is working with kernel developers to make their products Linux compatible. The initial version will have binary drivers only, but open sourced drivers are future possibility. It is also possible to make a direct ATM connection using a modem plus an ATM card, though this delivery system is not used in the U.S. as far as I know, and should not be considered as a viable option. This also requires a 2.4 kernel.

The most common type of modem in use today is actually a combination 'bridge' and modem device. The bridge is a simple device, typically with little configuration. Network traffic passes blindly across the bridge in either direction. Your point of exposure is the interface (typically a NIC) that is connected to the modem/bridge.

Some ISPs may also be offering 'routers'. These are basically combination modem/routers that can handle NAT, and may have other feature enhancements such as port forwarding, a built in hub, etc. These are all external, so should work too. But probably not a big deal for Linux users, since Linux can do anything these do, and more. A locked down Linux box makes a most excellent firewall/gateway/proxy!

To confuse things even more, there are also all-in-one devices: combo bridge+router+modem, sometimes called 'brouters'. In this case, the modem can be configured for either bridging or routing -- but it can't be both at the same time.

All providers should make available a 'modem' of some sort. Many ISPs will have more than one modem option. Some may give away the modem at no additional charge. Some may offer a free base model, and charge the difference for the better models with more features. Many of the modems that ISPs supply are not available through normal retail channels. Should you want to buy one yourself, this leaves used equipment outlets (e.g. ebay), or possibly buying a modem that your ISP may not support (i.e. a possibility of no tech support if you have a problem).

While some ISPs provide modems that are not readily available through normal retail channels, there are a number of manufacturers that are getting on the DSL modem bandwagon, and offering a good selection. Most have a number of enhancements. At this time Netgear, Linksys, Zyxel, Cisco, 3Com, and Cayman have products available. Depending on model and feature set, prices range from a little over $100 US to $800 and up. Many of these handle their own authentication and encapsulation (DHCP, PPPoE, etc).

Are some modems better than others? Well, fortunately for us the external, ethernet interfaced modems are the most reliable anyway. Fewer IRQ hassles, no buggy drivers, etc. So a blessing in disguise really. Are any of these better than others? Probably not. None are faster anyway. Certainly some may have more features, like the combo modem/routers. But realistically, most of this is so new there is not enough of a track record to compare brands and models with any degree of assurance. In other words, any old external, ethernet modem should do -- provided it matches your provider's DSL, and is configured for that service.

Warning! Make sure any third party modem or router you may purchase is compatible with your DSL provider. There are two major line encodings for ADSL (CAP, DMT a.k.a. Alcatel compatible), and several options for IP encapsulation. And different DSLs (SDSL, IDSL, etc) will require their own modem too. Your provider should have a list of compatible options. It may well have to be configured for your ISP's service too. Don't expect it to work right out of the box either (unless it comes from your provider). Many are accessible via telnet, or a web browser, where the configuration options are available. See the owner's manual for this.

6.4. The ISP Connection

The modem connects to the DSLAM, and then the DSLAM is connected to the telco's ATM network (or frame relay), where it is picked up by the ISP. The ISP will take over at what we 'see' as the first hop on a traceroute. Everything up to that point is in the hands of the telco/DSL provider. The ISP will connect to the ATM side of the DSLAM via a high-speed data connection, usually ATM over a T3 (45 Mbps) or OC-3 (155 Mbps). The important thing here is that an ISP must 'subscribe' with your telco to provide this connection. The ISP will provide traditional ISP type services: email, DNS, news, etc. It is really a two step connection -- DSL from one provider, Internet from a second -- even though these may be combined into one billing.

The Baby Bells (RBOCs) all own their own ISPs. These, of course, are connected to their DSLAMs, and are providing Internet services via the telco's ISP subsidiary. But, also many independent ISPs are availing themselves of the ILEC's DSL services, and in essence 'reselling' the DSL services of the ILEC. While the underlying infrastructure is the same in this case, having more than one ISP working out of a CO may mean a better selection of features and prices for the consumer.

Also, CLECs (independent telcos) are now installing their own DSLAMs. This makes them a direct competitor to the ILEC. In this scenario, there would be two (or more) DSL providers in the same CO, each with their own DSLAM(s), and each competing against each other. This complicates the ISP situation even further, as each DSL provider will be 'partnered' with one or more ISPs. If you are lucky here, you will have many choices of plans and pricing structures.

Typically, your service agreement is with the ISP, and not the DSL provider. This makes the actual DSL provider a 'behind the scenes' player. Though this may vary, and in some cases, you may wind up with a separate service agreement for both the DSL provider and the ISP.

See the Appendix for a list of Linux Friendly ISPs.

6.5. Availability

Who can get DSL? The first requirement is that a telco has installed the necessary hardware in your CO. You have no choice on which CO is yours -- it is wherever your loop terminates. If your CO has a DSLAM, and the necessary other components, then DSL may be available to you. This is often known as 'pre-qualifying', and is step one in getting service.

6.6. Choosing Providers

Should you have more than one choice, here are some things to keep in mind when comparing services from different providers. If you are in a populous area, chances are you do have a number of choices. There is a dizzying array of possibilities at this time. Remember too, that it is a two step connection: DSL provider and ISP. You may have choices for each.

• A compatible modem. For now with Linux (or any alternative OS) this essentially means an ethernet interface. 'Routers' (i.e. combo modem/routers) should be OK too since these seem to be all external, ethernet. Anything else, is a no-go! (This situation may be changing soon.)

• Installation. A self-install option, of course, let's anyone get up and running. And is less expensive. But if there is no self-install available, will the the provider install onto a Linux only site? Many will not! Having a Windows box (or Mac) temporarily available is a work around here. Even a laptop may be enough.

• Static vs Dynamic IP Address. If wanting to run servers, or hosting your own domain, static is the way to go.

• Encapsulation. Is the connection 'Bridged' or 'PPP'. PPPoX has the reputation of being not as stable a connection, and not 'always on'. PPPoE requires client software to manage the connection, so one more layer of code.

• Server Policy. Some ISPs are fairly open about this, while others forbid any servers -- even personal web sites. Others may even go so far as to block certain ports.

• Contract. Is there a contract, and what are the out clauses? Cancellation fees?

• Connection Limits. Is it 'always on' (at least theoretically :-)? Are there session limits, or idle timeouts? Is bandwidth metered and limited to so much per month? Do they forbid a LAN behind the connection (dumb!)?

• Linux Support. A few ISPs may offer some degree of tech support for Linux, but most will not. This isn't so bad, as long as they don't go overboard and refuse to help with anything just because you run a non-supported OS. ('Supported' means like 'tech support'.) If they say 'we don't care', you should be good to go.

• Free Dialup Account. A nice thing to have if the connection is down, or you just need to check mail from another location.

• Setup program. A few ISPs may have a setup program you are required to run the first time you connect in order to setup your account. This will likely not have a Linux version. (BellAtlantic.net was doing this at last report.) Other than this, there is nothing proprietary about DSL, and related protocols.

• Reliability and Quality of Service. Ask around in your local area from those that have the same DSL provider and ISP. A local LUG is a good place to get this kind of info. How much down time (hopefully not much)? Are mail and news services good? Backbone routing? Tech support?

There are a number of other options and features that might be worth looking at too: multiple IPs, domain hosting (reverse DNS), free web space, number of email accounts, web mail, etc.

8.1. Links

• Other related documentation from the Linux Documentation Project:

  • Firewall HOWTO

  • Security HOWTO

  • IPCHAINS HOWTO

  • IP Masquerade HOWTO

  • Home Network mini HOWTO

  • Ethernet HOWTO

  • Networking Overview HOWTO

  • Net HOWTO, previously named the NET3-4-HOWTO, the definitive guide to various Linux networking topics.

  • Linux 2.4 Advanced Routing HOWTO. All the new, improved features are explained here.

  • DHCP HOWTO

• More on the 2.4 kernel packet filtering from The Netfilter Project at http://netfilter.kernelnotes.org/. Several good HOWTOs for the new features in 2.4.

• Check your security and see what ports are open at http://hackerwhacker.com/. This is one of the better sites for this. Some only test a relatively few ports.

• SuSE's Linux PPPoE page is at http://www.suse.de/~bk/PPPoE-project.html. Good information on most available Linux PPPoE implementations.

• Bob Carrick's definitive PPPoE site is at http://www.carricksolutions.com/. His Linux PPPoE page is at http://www.carricksolutions.com/linuxpppoe.htm. Some other DSL related information as well. All OSes are covered.

• The NTS EnterNet for Linux FAQ can be found at http://www.nts.com/support/FaqEnterNetLinux.html. This is a non-GPL'd PPPoE client that is distributed by some ISPs.

• A white paper from Redback on the technology and rationale behind PPPoE can be found at http://www.redback.com/frameset.asp?page=whitepp/wp_pppoe_comparison.html. This is how the ISPs see it. (Redback is the leading manufacturer of PPPoX termination routers.)

• ATM on Linux: http://lrcwww.epfl.ch/linux-atm/. Where to find the latest info on PPPoA and raw ATM connections.

• A step by step report on getting Linux going with raw ATM is here: http://linux.com.sg/news/atm/.

• An open source project based on the Alcatel SpeedTouch Home USB modem can be found at http://kapu.name.daemon.xs4all.be:8080/Projects/. This is a beta project that requires 2.4 kernel and patches.

• FreeSwan, http://www.freeswan.org, is an IPSec & IKE VPN implementation for Linux.

• VPN and Masquerading on Linux: http://www.wolfenet.com/~jhardin/ip_masq_vpn.html

• PPTP-linux allows you to connect to a PPTP server with Linux. The home page is http://cag.lcs.mit.edu/~cananian/Projects/PPTP/.

• Justin Beech's http://dslreports.com, a great site for anything and everything related to DSL. If it's not there, then there is a link to it. (Site runs on Linux.)

• John Navas's Cable and DSL site, http://cable-dsl.home.att.net, has good general info, tweaks, troubleshooting, hardware info, etc. for all OSes.

• TCP Performance Tuning tips: http://www.psc.edu/networking/perf_tune.html. Tips on Linux, and other OSes.

• A great Linux security site is http://linux-firewall-tools.com/linux/. Lots of info from Robert L. Ziegler, author of Linux Firewalls. Many links to other security related sites as well.

• http://www.securityportal.com/lasg/, The Linux Administrator's Security Guide by Kurt Seifried. Good tutorials on a variety of topics -- not just firewalls, but the big picture.

• The Seattle firewall is an ipchains based firewall that can be used on a dedicated masquerading firewall machine (including LRP), a multi-function masquerade gateway/server or on a standalone Linux system. The project is located at http://seawall.sourceforge.net/

• My ipchains script is at http://personal.bellsouth.net/~hburgiss/linux/ipchains.html. This has IP Masquerading already set up, is reasonably well commented, and may make a quick starting point for your own script with only minor adjustments to suit your situation.

• Now that you have a full-time connection, want a routable hostname for your computer? Dynamic DNS services can do this, even if your IP changes from time to time. A few of the available services:

  • http://dyndns.org

  • http://tzo.org

  • http://eyep.net

• ADSL Forum Home Page: http://www.adsl.com A comprehensive web site created by the ADSL vendors. Fairly complete for reference information on ADSL.

• ADSL Deployment 'round the World Claims to have a complete list - looked accurate for my area - gives providers, prices, speeds, etc.

• comp.dcom.xdsl FAQ. Actively maintained, and a great technical reference for DSL technologies.

• comp.dcom.xdsl, DSL discussions, vents, and flames on Usenet. Good place to get technical questions answered that your ISP can't.

8.2. Glossary

A dictionary of some of the jargon used in this Document, and in the telco and DSL industries.

8.3. Other Consumer Class High Speed Services

8.4. Compatible Modems

This is an easy one right now ;-):

• All external, ethernet based modems, and modem combination devices, should work no problem. The only requirement is a compatible network card. (Technically speaking, there are a few, rare and very minor exceptions.)

This list is limited to those modems and delivery systems that are readily available, and should work with any current Linux distribution without having to go to extraordinary lengths. Alpha and Beta projects are not included.

8.5. Linux Friendly DSL ISPs

By 'friendly' we mean ISPs that don't put up any unnecessary impediments just because you aren't running that other guy's OS. And yes, there is some of that going around. If your choices are limited, and you are forced to deal with one of these, then having a Windows box available temporarily is one work around. Another, may be to sweet talk the installer into letting you finish the installation (NIC, etc). Of course, self installation, if available, should be completely 'Linux compatible'.

So to make this list, the ISP/provider must make available some type of workable modem (ethernet interface at this point in time). And, should not penalize you, or make things difficult, just because you are running an alternate OS. Installing directly onto Linux should be an available option, and should not cause you any undue hardship. Technical support for Linux is a nice bonus, but not necessary to make the list. Please do not take these as recommendations. Do your own homework.

To add a name to this list, mail Linux Friendly. Please included ISP's official name, URL (if not obvious), location and coverage area, modem type, server policy, and any other pertinent details.

National ISPs (U.S.):

• Speakeasy.net: Static IP and no PPPoX, servers explicitly allowed. Highly rated. National. Multiple IPs available.

• PhoenixDSL: Static IP and no PPPoX. National. Linux is supported. Servers apparently OK for non-commercial use. Tiered pricing plan.

• Telocity: Static IP, no PPPoX, liberal server policy. Reports of abysmal tech support. (Unenforced monthly bandwidth usage limit ???). National. They have their own proprietary modem, but it is ethernet based.

• Penguinista DSL, DSL with a twist. Not just Linux friendly, but Linux lovers. Sponsored by the Benevolent Penguin Society. National. Static IP available. "Theoretical" timeouts and session limits though. Encapsulation protocol (PPP?) unknown. ???

Regional and Local ISPs (U.S.):

• qx.net, Lexington, Ky., and areas of Central and Eastern KY. Officially supports Linux. Static IP. Personal servers allowed. Tiered pricing plans. Highly rated.

• Commonwealth Technical Services, Richmond, Va. Officially, and happily support Linux. Static IP. Personal servers allowed. No bandwidth restrictions. This ISP runs on Linux!

• ExecDSL, Baltimore, MD, Washington, DC and surrounding areas. Static IP. Servers are OK. Various plans and DSL providers. Secondary MX and DNS available (nice touch!). (Apparently no official Linux support.)

• Netexpress.net, Moline, Ill. Tiered pricing. Static IP available. Apparently, no official support. Runs on Linux!

• iglou.com, Lexington, Ky., and soon in Louisville, Ky, Cincinnati, OH, and maybe Nashville, TN. Static IP available. Personal servers allowed. Tiered pricing plans with various options.

• Bluegrass.net, Lexington, Ky., and surrounding areas. Static IP. Personal servers allowed. Tiered pricing plans.

• Drizzle.com, greater Seattle, WA area. Static IP, servers OK.

• Netsync.net, Chautauqua County, NY (Fredonia, Jamestown, and surrounding areas). Static IP available, PPPoA, servers are OK. Linux is supported!

• Aracnet, greater Seattle, WA., and Portland and Salem, OR. areas. Static IP. Linux friendly! Tiered pricing. Shell access account is included (RH)!

8.6. Setting up Linux as a Router

Depending on your local setup, you should consider some other issues. These include a firewall setup, and any associated configurations. For my setup, shown in Figure 5 below, I use an old i486 machine configured as a firewall/router between the DSL connection and the rest of my home network. I use private IP addresses on my private LAN subnet, and have configured my router to provide IP Masquerading and Firewalling between the LAN and WAN connection.

See the IP Masquerade HOWTO , and Firewall HOWTO for more information. Also, for 2.4 kernels see Linux 2.4 Advanced Routing HOWTO. My experience is that Linux is more flexible and provides superior routing/firewalling performance. And it is much less expensive than a commercial router -- if you find an old 486 machine that you may be using as a doorstop somewhere.

Figure 5: A typical SOHO Network Setup

  
 <--Private Subnet/LAN-> Linux <-----ISP's Public Subnet----><--inet-->
      192.168.1.0
 

 X--+   -------- 
    |   |      |        --------      (eth0:0)---------
    +--=| Hub/ |       | Linux  |     +------=|  DSL  |=-DSL-> ISP's
 X-----=|Switch|=-----=| System |=----+       | Modem |       Gateway
    +--=|      |  eth1 |(Router)| eth0        ---------
    |   --------    |   --------    |
 X--+               |   IP_Masq     |
                    |  IP_Firewall  |
                    |    Gateway    |
                    |               |
                    V               V
               192.168.1.1         Dynamic or
               LAN Gateway         Static IP
               IP Address          from ISP pool
                                   

 
   

What I did is setup a Linux router (Redhat Linux 5.0 on a i486) with two ethernet interfaces. One interface routes to the ISP subnet/gateway (eth0 in above example), and the other interface (eth1 above) goes to a hub (or switch) and then connects the LAN with private network addresses (e.g. 192.168.1.x). Using the private network address behind your router/firewall allows some additional security because it is not directly addressable from outside. You have to explicitly masquerade your private addresses in order to connect to the Internet from the LAN. The LAN hosts will access the Internet via the second NIC (eth1) in the Linux router. Just set their gateway to the IP address of the second NIC, and assign them addresses on the same network.

Caution Make sure your kernel is complied with IP forwarding and the IP forwarding is turned on. You can check this with 'cat /proc/sys/net/ipv4/ip_forward'. The value is '1' for on, and '0' for off. You can change this value by echoing the desired value into this file:

 # echo 1 > /proc/sys/net/ipv4/ip_forward
 

You will also need to set up 'IP Masquerading' on the Linux router. Depending on your kernel version, this is done with ipfwadm (2.0), ipchains (2.2), or iptables (2.4). See the documentation for specifics on each. AND -- do not forget to have that firewall set up too!

There are also several projects that are devoted specifically to using Linux as a router, just for this type of situation. These are all-in-one solutions, that include security and various other features. Installation and configuration, is reportedly very easy. And these will run on very minimal hardware -- like a floppy drive only. The best known is http://www.linuxrouter.org. You might also want to look at http://www.freesco.org and http://www.coyotelinux.com.