CEF over Serial

PLC · ‎06-19-2015

Hello All, I set up 3 routers with serial connections. When I ping I was getting success rate is 40 percent 2/5. After i disabled no ip cef i got 100 percent success on all routers.

I cant think of specific reason why this worked and should be disabled. Can anyone tell me why?

Thanks for your help!

R2#sho ip int brief

Interface IP-Address OK? Method Status Protocol

FastEthernet0/0 unassigned YES unset administratively down down

Serial1/0 unassigned YES unset administratively down down

Serial1/1 unassigned YES unset administratively down down

Serial1/2 unassigned YES unset administratively down down

Serial1/3 unassigned YES unset administratively down down

R2#config t

Enter configuration commands, one per line. End with CNTL/Z.

R2(config)#int serial 1/0

R2(config-if)#ip address 192.168.1.2 255.255.255.0

R2(config-if)#no shut

R2(config-if)#^Z

R2#

*Jun 19 11:31:27.955: %LINK-3-UPDOWN: Interface Serial1/0, changed state to up

*Jun 19 11:31:27.955: %ENTITY_ALARM-6-INFO: CLEAR INFO Se1/0 Physical Port Administrative State Down

R2#

*Jun 19 11:31:28.715: %SYS-5-CONFIG_I: Configured from console by console

*Jun 19 11:31:28.959: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!.!

Success rate is 80 percent (4/5), round-trip min/avg/max = 748/1370/1844 ms

R2#wr mem

Building configuration...

[OK]

R2#sho run int s1/1

Building configuration...

Current configuration : 76 bytes

!

interface Serial1/1

no ip address

shutdown

serial restart-delay 0

end

R2#config t

Enter configuration commands, one per line. End with CNTL/Z.

R2(config)#int serial1/1

R2(config-if)#ip address 192.168.1.6 255.255.255.0

R2(config-if)#no shut

R2(config-if)#^Z

R2#

*Jun 19 11:48:45.035: %LINK-3-UPDOWN: Interface Serial1/1, changed state to up

*Jun 19 11:48:45.035: %ENTITY_ALARM-6-INFO: CLEAR INFO Se1/1 Physical Port Administrative State Down

R2#

*Jun 19 11:48:45.487: %SYS-5-CONFIG_I: Configured from console by console

*Jun 19 11:48:46.039: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 244/1505/1968 ms

R2#sh run int serial1/0

Building configuration...

Current configuration : 89 bytes

!

interface Serial1/0

ip address 192.168.1.2 255.255.255.0

serial restart-delay 0

end

R2#sh run int serial1/1

Building configuration...

Current configuration : 89 bytes

!

interface Serial1/1

ip address 192.168.1.6 255.255.255.0

serial restart-delay 0

end

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/196/892 ms

R2#sho run

Building configuration...

Current configuration : 1146 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname R2

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

resource policy

!

ip subnet-zero

no ip icmp rate-limit unreachable

!

ip tcp synwait-time 5

ip cef

no ip domain lookup

no ip dhcp use vrf connected

!

no ip ips deny-action ips-interface

!

interface FastEthernet0/0

no ip address

shutdown

duplex half

!

interface Serial1/0

ip address 192.168.1.2 255.255.255.0

serial restart-delay 0

!

interface Serial1/1

ip address 192.168.1.6 255.255.255.0

serial restart-delay 0

!

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

!

ip classless

!

no ip http server

no ip http secure-server

!

no cdp log mismatch duplex

!

control-plane

!

gatekeeper

shutdown

!

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line vty 0 4

login

!

end

R2# sh int

FastEthernet0/0 is administratively down, line protocol is down

Hardware is DEC21140, address is ca02.5769.0000 (bia ca02.5769.0000)

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Half-duplex, 100Mb/s, 100BaseTX/FX

ARP type: ARPA, ARP Timeout 04:00:00

Last input never, output never, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

0 packets input, 0 bytes

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog

0 input packets with dribble condition detected

0 packets output, 0 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 babbles, 0 late collision, 0 deferred

1 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

Serial1/0 is up, line protocol is up

Hardware is M4T

Internet address is 192.168.1.2/24

MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation HDLC, crc 16, loopback not set

Keepalive set (10 sec)

Restart-Delay is 0 secs

Last input 00:00:10, output 00:00:05, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: weighted fair

Output queue: 0/1000/64/0 (size/max total/threshold/drops)

Conversations 0/1/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 1158 kilobits/sec

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

172 packets input, 12050 bytes, 0 no buffer

Received 152 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

177 packets output, 12929 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 output buffer failures, 0 output buffers swapped out

2 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

Serial1/1 is up, line protocol is up

Hardware is M4T

Internet address is 192.168.1.6/24

MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation HDLC, crc 16, loopback not set

Keepalive set (10 sec)

Restart-Delay is 0 secs

Last input 00:00:00, output 00:00:04, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: weighted fair

Output queue: 0/1000/64/0 (size/max total/threshold/drops)

Conversations 0/1/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 1158 kilobits/sec

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

51 packets input, 4372 bytes, 0 no buffer

Received 42 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

60 packets output, 5277 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 output buffer failures, 0 output buffers swapped out

2 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

Serial1/2 is administratively down, line protocol is down

Hardware is M4T

MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation HDLC, crc 16, loopback not set

Keepalive set (10 sec)

Restart-Delay is 0 secs

Last input never, output never, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: weighted fair

Output queue: 0/1000/64/0 (size/max total/threshold/drops)

Conversations 0/0/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 1158 kilobits/sec

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 packets output, 0 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 output buffer failures, 0 output buffers swapped out

1 carrier transitions DCD=down DSR=down DTR=up RTS=up CTS=down

Serial1/3 is administratively down, line protocol is down

Hardware is M4T

MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation HDLC, crc 16, loopback not set

Keepalive set (10 sec)

Restart-Delay is 0 secs

Last input never, output never, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: weighted fair

Output queue: 0/1000/64/0 (size/max total/threshold/drops)

Conversations 0/0/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 1158 kilobits/sec

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 packets output, 0 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 output buffer failures, 0 output buffers swapped out

1 carrier transitions DCD=down DSR=down DTR=up RTS=up CTS=down

R2# ping 192.168.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/548/1048 ms

R2#ping 192.168.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/177/796 ms

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

..!!!

Success rate is 60 percent (3/5), round-trip min/avg/max = 20/146/384 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R2#sho run

Building configuration...

Current configuration : 1146 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname R2

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

resource policy

!

ip subnet-zero

no ip icmp rate-limit unreachable

!

ip tcp synwait-time 5

ip cef

no ip domain lookup

no ip dhcp use vrf connected

!

no ip ips deny-action ips-interface

!

interface FastEthernet0/0

no ip address

shutdown

duplex half

!

interface Serial1/0

ip address 192.168.1.2 255.255.255.0

serial restart-delay 0

!

interface Serial1/1

ip address 192.168.1.6 255.255.255.0

serial restart-delay 0

!

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

!

ip classless

!

no ip http server

no ip http secure-server

!

no cdp log mismatch duplex

!

control-plane

!

gatekeeper

shutdown

!

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line vty 0 4

login

!

end

R2#config t

Enter configuration commands, one per line. End with CNTL/Z.

R2(config)#no ip cef

R2(config)#^Z

R2#config t

*Jun 19 12:16:58.631: %SYS-5-CONFIG_I: Configured from console by console

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.!!.!

Success rate is 60 percent (3/5), round-trip min/avg/max = 28/30/32 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.!.!.

Success rate is 40 percent (2/5), round-trip min/avg/max = 28/56/84 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!.!.!

Success rate is 60 percent (3/5), round-trip min/avg/max = 32/212/556 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.!.!.

Success rate is 40 percent (2/5), round-trip min/avg/max = 40/42/44 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 48/73/128 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/232/1044 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!.!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 44/528/1140 ms

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 24/198/888 ms

R2#sho run

Building configuration...

Current configuration : 1149 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname R2

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

resource policy

!

ip subnet-zero

no ip icmp rate-limit unreachable

!

ip tcp synwait-time 5

no ip cef

no ip domain lookup

no ip dhcp use vrf connected

!

no ip ips deny-action ips-interface

!

interface FastEthernet0/0

no ip address

shutdown

duplex half

!

interface Serial1/0

ip address 192.168.1.2 255.255.255.0

serial restart-delay 0

!

interface Serial1/1

ip address 192.168.1.6 255.255.255.0

serial restart-delay 0

!

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

!

ip classless

!

no ip http server

no ip http secure-server

!

no cdp log mismatch duplex

!

control-plane

!

gatekeeper

shutdown

!

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

stopbits 1

line vty 0 4

login

!

end

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 24/291/1328 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!.!.

Success rate is 60 percent (3/5), round-trip min/avg/max = 12/198/544 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!.!.!

Success rate is 60 percent (3/5), round-trip min/avg/max = 20/146/388 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

.!.!.

Success rate is 40 percent (2/5), round-trip min/avg/max = 20/32/44 ms

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!.!.!

Success rate is 60 percent (3/5), round-trip min/avg/max = 20/190/508 ms

R2#

R2#sho run

Building configuration...

Current configuration : 1149 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname R2

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

resource policy

!

ip subnet-zero

no ip icmp rate-limit unreachable

!

ip tcp synwait-time 5

no ip cef

R2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 24/409/1048 ms

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/199/852 ms

R2#ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/144/616 ms

R2#

Peter Paluch · ‎06-22-2015

Hi,

This is strange. There is no reason for a well-behaved CEF implementation to cause packet losses like the ones you have experienced in your network.

Based on the types of interfaces and IOS versions you're using, am I correct in assuming you are running this topology on a GNS3/Dynagen/Dynamips simulator? If so, I suggest upgrading that in the first place.

Also, does this behavior persist when you try a different IOS version?

Best regards,
Peter

PLC · ‎06-22-2015

Thanks for chiming in Peter! Yes, I got this going on GNS3 dynamips simulation. I havent tried on a different ios. I will try upgrading gns3... see what that does.

PLC · ‎06-22-2015

ok, I upgraded my gns3 to the latest and greatest and i tried a different iOS and it behaved the same.

as soon as i introduce a third router thats when it starts dropping packets until i disable no ip cef. Weird.. once i do that pings are success 5/5

Peter Paluch · ‎06-22-2015

Hi,

Can you post a snapshot of your GNS3 window so that the topology is more clear? Also, what exact IOS are you running?

Best regards,
Peter

PLC · ‎06-23-2015

Software (C7200-JK9O3S-M), Version 12.4(1a), RELEASE SOFTWARE (fc2)- I orginally used the above iOS

(C3620-J1S3-M), Version 12.3(13), RELEASE SOFTWARE (fc2)- I tried this the second time after I upgraded the gns 3.

I attached a screen shot. pretty simple /24 on each interface all interfaces are in the up and up state.

Peter Paluch · ‎06-23-2015

Hi,

I've noticed a glitch in your configuration: On R2, both serial interfaces are in the same IP network 192.168.1.0 (your netmask is /24 on both interfaces). In general, this is an invalid configuration, as two routed interfaces cannot be in the same IP subnet. For some reason long unknown to me, routers allow you to configure multiple serial interfaces for the same IP subnet even though it does not make much sense.

In any case, if R2 believes it has two routes into the same network - which it apparently believes right now - it is allowed to do load-balancing, and this may actually be the reason why your pings have been intermittently lost.

Try reconfiguring your topology so that the R1/R2 subnet is unique and different from R2/R3 subnet, say:

R1/R2: 192.168.12.0/24, R1 = .1, R2 = .2
R2/R3: 192.168.23.0/24, R2 = .2, R3 = .3

The reason why deactivating CEF might have had an influence on the success of the pings is probably more complex. Packets originated by a router alone are always process-switched and are not subject to CEF. However, if, for a particular pinged destination, R2 arbitrarily chose the source IP and the egress interface, it may have happened that the ping went just to the opposite router than the one it was destined to. The opposite router would have routed the packet back (the logic of serial interfaces is that every IP address in the serial interface's network is located on the other end), and now, because this packet was received back, it was no longer locally originated but rather a received packet eligible for routing, so CEF applies to it. By default, CEF performs per-destination load balancing, hashing the source and destination IP and performing a path choice. As I mentioned, the original packet had its source IP address arbitrarily chosen, depending on the original egress interface. It is quite possible that for a specific combination of the source and destination IP, R2 gets the packet back and decides to forward the packet received from the other router back to the same other router, essentially creating a routing loop. That would explain the lost packets. Without CEF, the next forwarding method would be the route cache and finally process switching. I am not sure at this moment what the behavior would be with the route cache. However, with process switching, packets would eventually make it because process switching performs a per-packet load balancing, so the packet would possibly make multiple turns before making it out the correct interface.

In any case, you configuration needs to be corrected - after doing that, I believe that the packet losses will no longer occur.

Best regards,
Peter

PLC · ‎06-24-2015

Doh! thank you Paul. That was the issue... all is pinging now that i put them in different subnets lol... I usually put a /30 not sure why I put /24.