firewall docs - simplestream and nuttcp? #277

Activity

1. mfeit-internet2 commented on Oct 13, 2026

   

   mfeit-internet2

   on Oct 13, 2026

   Member

   More actions

   Are simplestream and nuttcp in active use?

   The troubleshooter runs a simplestream as part of the troubleshooting process and should be considered active use. The simplestreamer, plug-in that runs that test re-uses Iperf3's port range. The version of the troubleshooter to be released in 5.3 will run the noop test, which does nothing with the network, if all hosts involved have it available.

   I couldn't tell you how much nuttcp gets used because we don't keep track of what's used and what isn't. We don't typically remove plugins unless there's a good reason, so it will be with us for the foreseeable future.

   Can you disable those tests so that pscheduler can't negotiate them? And maybe the same question for twamp, given owamp is (I assume) more common.

   The keep-the-security-people-happiest route would be to remove (or not install) plugins that do anything unwanted. That will make pScheduler completely unaware that they exist. E.g., you could remove pscheduler-tool-twping to make it incapable of TWAMP tests with twping or pscheduler-test-latency to make it incapable of latency tests entirely.

   I'd recommend configuring the limits to reject anything you don't want to happen.

   I see Ethr isn't mentioned, for which I believe the default port is 8888 - should it be?

   The ethr plugin also re-uses the iperf3 range.

   In general, you don't have to open ports for anything you don't want to allow. People tend to expect that perfSONAR nodes will have the full set of plugins that we ship, and "we've rejected your request" is a better response than "I have no idea what you mean by 'latency'."

   👍React with 👍1Reacted by Tim Chown
2. mfeit-internet2

   closed this as completedon Oct 13, 2026