1.\" $OpenBSD: bridge.4,v 1.66 2007/10/03 20:15:06 sthen Exp $ 2.\" 3.\" Copyright (c) 1999-2001 Jason L. Wright (jason@thought.net) 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17.\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 18.\" DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, 19.\" INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 20.\" (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 21.\" SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 23.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 24.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25.\" POSSIBILITY OF SUCH DAMAGE. 26.\" 27.Dd $Mdocdate: October 3 2007 $ 28.Dt BRIDGE 4 29.Os 30.Sh NAME 31.Nm bridge 32.Nd Ethernet bridge interface 33.Sh SYNOPSIS 34.Cd "pseudo-device bridge" 35.Pp 36.Fd #include <sys/types.h> 37.Fd #include <net/if.h> 38.Fd #include <netinet/in.h> 39.Fd #include <netinet/if_ether.h> 40.Fd #include <net/if_bridge.h> 41.Sh DESCRIPTION 42The 43.Nm 44device creates a logical link between two or more Ethernet interfaces or 45encapsulation interfaces (see 46.Xr gif 4 ) . 47This link between the interfaces selectively forwards frames from 48each interface on the bridge to every other interface on the bridge. 49A bridge can serve several services, including isolation of traffic between 50sets of machines so that traffic local to one set of machines is not 51available on the wire of another set of machines, and it can act as 52a transparent filter for 53.Xr ip 4 54datagrams. 55.Pp 56A 57.Nm 58interface can be created at runtime using the 59.Ic ifconfig bridge Ns Ar N Ic create 60command or by setting up a 61.Xr bridgename.if 5 62configuration file for 63.Xr netstart 8 . 64.Pp 65The bridges provided by this interface are learning bridges with 66filtering; see 67.Xr pf 4 . 68In general a bridge works like a hub, forwarding traffic from one interface 69to another. 70It differs from a hub in that it will "learn" which machines 71are on each of its attached segments by actively listening to 72incoming traffic and examining the headers of each frame. 73A table is built containing the MAC address and segment to which the 74MAC address is attached. 75This allows a bridge to be more selective about what it forwards, 76which can be used to reduce traffic on a set of segments and also to provide 77an IP firewall without changing the topology of the network. 78.Pp 79The algorithm works as follows by default, but can be modified via 80.Xr ioctl 2 81or the utility 82.Xr brconfig 8 . 83When a frame comes in, the origin segment and the source address are 84recorded. 85If the bridge has no knowledge about where the destination is to be found, 86the bridge will forward the frame to all attached segments. 87If the destination is known to be on a different segment from its origin, the 88bridge will forward the packet only to the destination segment. 89If the destination is on the same segment as the origin segment, the bridge 90will drop the packet because the receiver has already had a chance to see 91the frame. 92Before forwarding a frame, the bridge will check to see if the packet 93contains an 94.Xr ip 4 95or 96.Xr ip6 4 97datagram; if so, the datagram is run through the 98pf interface so that it can be filtered. 99See the 100.Sx NOTES 101section for details. 102.Sh IOCTLS 103A 104.Nm 105interface responds to all of the 106.Xr ioctl 2 107calls specific to other interfaces listed in 108.Xr netintro 4 . 109The following 110.Xr ioctl 2 111calls are specific to 112.Nm 113devices. 114They are defined in 115.Aq Pa sys/sockio.h . 116.Bl -tag -width Ds 117.It Dv SIOCBRDGIFS Fa "struct ifbifconf *" 118Retrieve member interface list from a bridge. 119This request takes an 120.Vt ifbifconf 121structure (see below) as a value-result parameter. 122The 123.Va ifbic_len 124field should be initially set to the size of the buffer 125pointed to by 126.Va ifbic_buf . 127On return it will contain the length, in bytes, of the configuration 128list. 129.Pp 130Alternatively, if the 131.Va ifbic_len 132passed in is set to 0, 133.Dv SIOCBRDGIFS 134will set 135.Va ifbic_len 136to the size that 137.Va ifbic_buf 138needs to be to fit the entire configuration list, 139and will not fill in the other parameters. 140This is useful for determining the exact size that 141.Va ifbic_buf 142needs to be in advance. 143.Pp 144The argument structure is defined as follows: 145.Bd -literal 146struct ifbreq { 147 char ifbr_name[IFNAMSIZ]; /* bridge ifs name */ 148 char ifbr_ifsname[IFNAMSIZ];/* member ifs name */ 149 u_int32_t ifbr_ifsflags; /* member ifs flags */ 150 u_int8_t ifbr_state; /* member stp state */ 151 u_int8_t ifbr_priority; /* member stp priority */ 152 u_int8_t ifbr_portno; /* member port number */ 153 u_int32_t ifbr_path_cost; /* member stp path cost */ 154}; 155 156/* ifbr_ifsflags flags about interfaces */ 157#define IFBIF_LEARNING 0x0001 /* ifs can learn */ 158#define IFBIF_DISCOVER 0x0002 /* sends packets w/unknown dst */ 159#define IFBIF_BLOCKNONIP 0x0004 /* ifs blocks non-IP/ARP in/out */ 160#define IFBIF_STP 0x0008 /* participate in spanning tree*/ 161#define IFBIF_SPAN 0x0100 /* ifs is a span port (ro) */ 162#define IFBIF_RO_MASK 0xff00 /* read only bits */ 163 164struct ifbifconf { 165 char ifbic_name[IFNAMSIZ]; /* bridge ifs name */ 166 u_int32_t ifbic_len; /* buffer size */ 167 union { 168 caddr_t ifbicu_buf; 169 struct ifbreq *ifbicu_req; 170 } ifbic_ifbicu; 171#define ifbic_buf ifbic_ifbicu.ifbicu_buf 172#define ifbic_req ifbic_ifbicu.ifbicu_req 173}; 174.Ed 175.It Dv SIOCBRDGADD Fa "struct ifbreq *" 176Add the interface named in 177.Va ifbr_ifsname 178to the bridge named in 179.Va ifbr_name . 180.It Dv SIOCBRDGDEL Fa "struct ifbreq *" 181Delete the interface named in 182.Va ifbr_ifsname 183from the bridge named in 184.Va ifbr_name . 185.It Dv SIOCBRDGADDS Fa "struct ifbreq *" 186Add the interface named in 187.Va ifbr_ifsname 188as a span port to the bridge named in 189.Va ifbr_name . 190.It Dv SIOCBRDGDELS Fa "struct ifbreq *" 191Delete the interface named in 192.Va ifbr_ifsname 193from the list of span ports of the bridge named in 194.Va ifbr_name . 195.It Dv SIOCBRDGSIFFLGS Fa "struct ifbreq *" 196Set the bridge member interface flags for the interface named in 197.Va ifbr_ifsname 198attached to the bridge 199.Va ifbr_name . 200If the flag 201.Dv IFBIF_LEARNING 202is set on an interface, source addresses from frames received on the 203interface are recorded in the address cache. 204If the flag 205.Dv IFBIF_DISCOVER 206is set, the interface will receive packets destined for unknown 207destinations, otherwise a frame that has a destination not found 208in the address cache is not forwarded to this interface. 209The default for newly added interfaces has both flags set. 210If the flag 211.Dv IFBIF_BLOCKNONIP 212is set, packets that are one of 213.Xr ip 4 , 214.Xr ip6 4 , 215.Xr arp 4 , 216or 217Reverse ARP will not be bridged from and to the interface. 218.It Dv SIOCBRDGGIFFLGS Fa "struct ifbreq *" 219Retrieve the bridge member interface flags for the interface named in 220.Va ifbr_ifsname 221attached to the bridge 222.Va ifbr_name . 223.It Dv SIOCBRDGRTS Fa "struct ifbaconf *" 224Retrieve the address cache of the bridge named in 225.Va ifbac_name . 226This request takes an 227.Vt ifbaconf 228structure (see below) as a value-result parameter. 229The 230.Va ifbac_len 231field should be initially set to the size of the buffer pointed to by 232.Va ifbac_buf . 233On return, it will contain the length, in bytes, of the configuration list. 234.Pp 235Alternatively, if the 236.Va ifbac_len 237passed in is set to 0, 238.Dv SIOCBRDGRTS 239will set it to the size that 240.Va ifbac_buf 241needs to be to fit the entire configuration list, and will not fill in the other 242parameters. 243As with 244.Dv SIOCBRDGIFS , 245this is useful for determining the exact size that 246.Va ifbac_buf 247needs to be in advance. 248.Pp 249The argument structure is defined as follows: 250.Bd -literal 251struct ifbareq { 252 char ifba_name[IFNAMSIZ]; /* bridge name */ 253 char ifba_ifsname[IFNAMSIZ];/* destination ifs */ 254 u_int8_t ifba_age; /* address age */ 255 u_int8_t ifba_flags; /* address flags */ 256 struct ether_addr ifba_dst; /* destination addr */ 257}; 258 259#define IFBAF_TYPEMASK 0x03 /* address type mask */ 260#define IFBAF_DYNAMIC 0x00 /* dynamically learned */ 261#define IFBAF_STATIC 0x01 /* static address */ 262 263struct ifbaconf { 264 char ifbac_name[IFNAMSIZ]; /* bridge ifs name */ 265 u_int32_t ifbac_len; /* buffer size */ 266 union { 267 caddr_t ifbacu_buf; /* buffer */ 268 struct ifbareq *ifbacu_req; /* request pointer */ 269 } ifbac_ifbacu; 270#define ifbac_buf ifbac_ifbacu.ifbacu_buf 271#define ifbac_req ifbac_ifbacu.ifbacu_req 272}; 273.Ed 274.Pp 275Address cache entries with the type set to 276.Dv IFBAF_DYNAMIC 277in 278.Va ifba_flags 279are entries learned by the bridge. 280Entries with the type set to 281.Dv IFBAF_STATIC 282are manually added entries. 283.It Dv SIOCBRDGSADDR Fa "struct ifbareq *" 284Add an entry, manually, to the address cache for the bridge named in 285.Va ifba_name . 286The address and its associated interface and flags are set in the 287.Va ifba_dst , 288.Va ifba_ifsname , 289and 290.Va ifba_flags 291fields, respectively. 292.It Dv SIOCBRDGDADDR Fa "struct ifbareq *" 293Delete an entry from the address cache of the bridge named in 294.Va ifba_name . 295Entries are deleted strictly based on the address field 296.Va ifba_dst . 297.It Dv SIOCBRDGFLUSH Fa "struct ifbreq *" 298Flush addresses from the cache. 299.Va ifbr_name 300contains the name of the bridge device, and 301.Va ifbr_ifsflags 302should be set to 303.Dv IFBF_FLUSHALL 304to flush all addresses from the cache or 305.Dv IFBF_FLUSHDYN 306to flush only the dynamically learned addresses from the cache. 307.It Dv SIOCBRDGSCACHE Fa "struct ifbrparam *" 308Set the maximum address cache size for the bridge named in 309.Va ifbrp_name 310to 311.Va ifbrp_csize 312entries. 313.Pp 314The argument structure is as follows: 315.Bd -literal 316struct ifbrparam { 317 char ifbrp_name[IFNAMSIZ]; 318 union { 319 u_int32_t ifbrpu_csize; /* cache size */ 320 int ifbrpu_ctime; /* cache time */ 321 u_int16_t ifbrpu_prio; /* bridge priority */ 322 u_int8_t ifbrpu_hellotime; /* hello time */ 323 u_int8_t ifbrpu_fwddelay; /* fwd delay */ 324 u_int8_t ifbrpu_maxage; /* max age */ 325 } ifbrp_ifbrpu; 326}; 327#define ifbrp_csize ifbrp_ifbrpu.ifbrpu_csize 328#define ifbrp_ctime ifbrp_ifbrpu.ifbrpu_ctime 329#define ifbrp_prio ifbrp_ifbrpu.ifbrpu_prio 330#define ifbrp_hellotime ifbrp_ifbrpu.ifbrpu_hellotime 331#define ifbrp_fwddelay ifbrp_ifbrpu.ifbrpu_fwddelay 332#define ifbrp_maxage ifbrp_ifbrpu.ifbrpu_maxage 333.Ed 334.Pp 335Note that the 336.Va ifbrp_ctime , ifbrp_hellotime , ifbrp_fwddelay 337and 338.Va ifbrp_maxage 339fields are in seconds. 340.It Dv SIOCBRDGGCACHE Fa "struct ifbrparam *" 341Retrieve the maximum size of the address cache for the bridge 342.Va ifbrp_name . 343.It Dv SIOCBRDGSTO Fa "struct ifbrparam *" 344Set the time, in seconds, for how long addresses which have not been 345seen on the network (i.e., have not transmitted a packet) will remain in 346the cache to the value 347.Va ifbrp_ctime . 348If the time is set to zero, no aging is performed on the address cache. 349.It Dv SIOCBRDGGTO Fa "struct ifbrparam *" 350Retrieve the address cache expiration time (see above). 351.It Dv SIOCBRDGARL Fa "struct ifbrlreq *" 352Add an Ethernet address filtering rule to the bridge on a specific interface. 353.Va ifbr_name 354contains the name of the bridge device, and 355.Va ifbr_ifsname 356contains the name of the bridge member interface. 357.Pp 358Rules are applied in the order in which they were added to the bridge, 359and the first matching rule's action parameter determines the fate of 360the packet. 361The 362.Va ifbr_action 363field is one of 364.Dv BRL_ACTION_PASS 365or 366.Dv BRL_ACTION_BLOCK , 367to pass or block matching frames, respectively. 368The 369.Va ifbr_flags 370field specifies whether the rule should match on input, output, or both 371by using the flags 372.Dv BRL_FLAG_IN 373and 374.Dv BRL_FLAG_OUT . 375At least one of these flags must be set. 376.Pp 377The 378.Va ifbr_flags 379field 380also specifies whether either (or both) of the source and destination 381addresses should be matched by using the 382.Dv BRL_FLAG_SRCVALID 383and 384.Dv BRL_FLAG_DSTVALID 385flags. 386The 387.Va ifbr_src 388field is the source address that triggers the rule (only considered if 389.Va ifbr_flags 390has the 391.Dv BRL_FLAG_SRCVALID 392bit set). 393The 394.Va ifbr_src 395field is the destination address that triggers the rule (only considered if 396.Va ifbr_flags 397has the 398.Dv BRL_FLAG_DSTVALID 399bit set). 400If neither bit is set, the rule matches all frames. 401.Pp 402The argument structure is as follows: 403.Bd -literal 404struct ifbrlreq { 405 char ifbr_name[IFNAMSIZ]; /* bridge ifs name */ 406 char ifbr_ifsname[IFNAMSIZ]; /* member ifs name */ 407 u_int8_t ifbr_action; /* disposition */ 408 u_int8_t ifbr_flags; /* flags */ 409 struct ether_addr ifbr_src; /* source mac */ 410 struct ether_addr ifbr_dst; /* destination mac */ 411 char ifbr_tagname[PF_TAG_NAME_SIZE]; /* pf tagname */ 412}; 413#define BRL_ACTION_BLOCK 0x01 /* block frame */ 414#define BRL_ACTION_PASS 0x02 /* pass frame */ 415#define BRL_FLAG_IN 0x08 /* input rule */ 416#define BRL_FLAG_OUT 0x04 /* output rule */ 417#define BRL_FLAG_SRCVALID 0x02 /* src valid */ 418#define BRL_FLAG_DSTVALID 0x01 /* dst valid */ 419.Ed 420.It Dv SIOCBRDGFRL Fa "struct ifbrlreq *" 421Remove all filtering rules from a bridge interface member. 422.Va ifbr_name 423contains the name of the bridge device, and 424.Va ifbr_ifsname 425contains the name of the bridge member interface. 426.It Dv SIOCBRDGGRL Fa "struct ifbrlconf *" 427Retrieve all of the rules from the bridge, 428.Va ifbrl_name , 429for the member interface, 430.Va ifbrl_ifsname . 431This request takes an 432.Vt ifbrlconf 433structure (see below) as a value-result parameter. 434The 435.Va ifbrl_len 436field should be initially set to the size of the buffer pointed to by 437.Va ifbrl_buf . 438On return, it will contain the length, in bytes, of the configuration list. 439.Pp 440Alternatively, if the 441.Va ifbrl_len 442passed in is set to 0, 443.Dv SIOCBRDGGRL 444will set it to the size that 445.Va ifbrl_buf 446needs to be to fit the entire configuration list, and will not fill in the other 447parameters. 448As with 449.Dv SIOCBRDGIFS , 450this is useful for determining the exact size that 451.Va ifbrl_buf 452needs to be in advance. 453.Pp 454The argument structure is defined as follows: 455.Bd -literal 456struct ifbrlconf { 457 char ifbrl_name[IFNAMSIZ]; /* bridge ifs name */ 458 char ifbrl_ifsname[IFNAMSIZ]; /* member ifs name */ 459 u_int32_t ifbrl_len; /* buffer size */ 460 union { 461 caddr_t ifbrlu_buf; 462 struct ifbrlreq *ifbrlu_req; 463 } ifbrl_ifbrlu; 464#define ifbrl_buf ifbrl_ifbrlu.ifbrlu_buf 465#define ifbrl_req ifbrl_ifbrlu.ifbrlu_req 466}; 467.Ed 468.\" .It Dv SIOCBRDGGSIFS Fa "struct ifbreq *" 469.It Dv SIOCBRDGGPRI Fa "struct ifbrparam *" 470Retrieve the Spanning Tree Protocol (STP) priority parameter of the bridge into 471the 472.Va ifbrp_prio 473field. 474.It Dv SIOCBRDGSPRI Fa "struct ifbrparam *" 475Set the STP priority parameter of the bridge to the value in 476.Va ifbrp_prio . 477.It Dv SIOCBRDGGHT Fa "struct ifbrparam *" 478Retrieve the STP hello time parameter, in seconds, of the bridge into the 479.Va ifbrp_hellotime 480field. 481.It Dv SIOCBRDGSHT Fa "struct ifbrparam *" 482Set the STP hello time parameter, in seconds, of the bridge to the value in 483.Va ifbrp_hellotime . 484The value in 485.Va ifbrp_hellotime 486cannot be zero. 487.It Dv SIOCBRDGGFD Fa "struct ifbrparam *" 488Retrieve the STP forward delay parameter, in seconds, of the bridge into the 489.Va ifbrp_fwddelay 490field. 491.It Dv SIOCBRDGSFD Fa "struct ifbrparam *" 492Set the STP forward delay parameter, in seconds, of the bridge to the value in 493.Va ifbrp_fwddelay . 494The value in 495.Va ifbrp_fwddelay 496cannot be zero. 497.It Dv SIOCBRDGGMA Fa "struct ifbrparam *" 498Retrieve the STP maximum age parameter, in seconds, of the bridge into the 499.Va ifbrp_maxage 500field. 501.It Dv SIOCBRDGSMA Fa "struct ifbrparam *" 502Set the STP maximum age parameter, in seconds, of the bridge to the value in 503.Va ifbrp_maxage . 504The value in 505.Va ifbrp_maxage 506cannot be zero. 507.It Dv SIOCBRDGSIFPRIO Fa "struct ifbreq *" 508Set the STP priority parameter of the interface named in 509.Va ifbr_ifsname 510to the value in 511.Va ifbr_priority . 512.It Dv SIOCBRDGSIFCOST Fa "struct ifbreq *" 513Set the STP cost parameter of the interface named in 514.Va ifbr_ifsname 515to the value in 516.Va ifbr_path_cost . 517The value in 518.Va ifbr_path_cost 519must be greater than or equal to one. 520.El 521.Sh ERRORS 522If the 523.Xr ioctl 2 524call fails, 525.Xr errno 2 526is set to one of the following values: 527.Bl -tag -width Er 528.It Bq Er ENOENT 529For an add request, this means that the named interface is not configured 530into the system. 531For a delete operation, it means that the named interface is not a member 532of the bridge. 533For an address cache deletion, the address was not found in the table. 534.It Bq Er ENOMEM 535Memory could not be allocated for an interface or cache entry 536to be added to the bridge. 537.It Bq Er EEXIST 538The named interface is already a member of the bridge. 539.It Bq Er EBUSY 540The named interface is already a member of another bridge. 541.It Bq Er EINVAL 542The named interface is not an Ethernet interface, or an invalid ioctl 543was performed on the bridge. 544.It Bq Er ENETDOWN 545Address cache operation (flush, add, or delete) on a bridge that is 546in the down state. 547.It Bq Er EPERM 548Super-user privilege is required to add and delete interfaces to and from 549bridges and to set the bridge interface flags. 550.It Bq Er EFAULT 551The buffer used in a 552.Dv SIOCBRDGIFS 553or 554.Dv SIOCBRDGRTS 555request points outside of the process's allocated address space. 556.It Bq Er ESRCH 557No such member interface in the bridge. 558.El 559.Sh NOTES 560Bridged packets pass through 561.Xr pf 4 562filters once as input on the receiving interface and once 563as output on all interfaces on which they are forwarded. 564In order to pass through the bridge packets must pass 565any 566.Ar in 567rules on the input and any 568.Ar out 569rules on the output interface. 570Packets may be blocked either entering or leaving the bridge. 571.Pp 572Return packets generated by pf itself are not routed using the 573kernel routing table. 574Instead, pf will send these replies back to the same Ethernet 575address that the original packet came from. 576This applies to rules with 577.Ic return , 578.Ic return-rst , 579.Ic return-icmp , 580.Ic return-icmp6 , 581or 582.Ic synproxy 583defined. 584At the moment, only 585.Ic return-rst 586on IPv4 is implemented and the other packet generating rules 587are unsupported. 588.Pp 589If an IP packet is too large for the outgoing interface, the bridge 590will perform IP fragmentation. 591This can happen when bridge members 592have different MTUs or when IP fragments are reassembled by pf. 593Non-IP packets which are too large for the outgoing interface will be 594dropped. 595.Pp 596If the 597.Dv IFF_LINK2 598flag is set on the 599.Nm 600interface, the bridge will also perform transparent 601.Xr ipsec 4 602processing on the packets (encrypt or decrypt them), according to the 603policies set with the 604.Xr ipsecctl 8 605command by the administrator. 606If appropriate security associations (SAs) do not exist, any key 607management daemons such as 608.Xr isakmpd 8 609that are running on the bridge will be invoked to establish the 610necessary SAs. 611These daemons have to be configured as if they were running on the 612host whose traffic they are protecting (i.e., they need to have the 613appropriate authentication and authorization material, such as keys 614and certificates, to impersonate the protected host(s)). 615.Sh SEE ALSO 616.Xr errno 2 , 617.Xr ioctl 2 , 618.Xr arp 4 , 619.Xr gif 4 , 620.Xr ip 4 , 621.Xr ip6 4 , 622.Xr ipsec 4 , 623.Xr netintro 4 , 624.Xr pf 4 , 625.Xr bridgename.if 5 , 626.Xr brconfig 8 , 627.Xr ipsecctl 8 , 628.Xr isakmpd 8 , 629.Xr netstart 8 630.Sh HISTORY 631The 632.Xr brconfig 8 633command and the 634.Nm 635kernel interface first appeared in 636.Ox 2.5 . 637.Sh AUTHORS 638The 639.Xr brconfig 8 640command and the 641.Nm 642kernel interface were written by 643.An Jason L. Wright Aq jason@thought.net 644as part of an undergraduate independent study at the 645University of North Carolina at Greensboro. 646