Hi Andrei, can you establish any criteria for that doubled traffic, ie. what gets doubled and what is counted once, inbound vs. outbound, etc.? Moreover, can you have a look what happens at layer2, any change in src/dst MAC addresses? That would help but because you told that's bridged traffic ... there should be not much of surprises down there.
Cheers, Paolo On Sat, Apr 14, 2007 at 01:37:44AM +0300, Andrei Neagoe wrote: > [ ... ] > > ======= > 00:31:56.734917 IP 127-0xxx.dk.ircd > > a91-153-5-49.elisa-laajakaista.fi.1465: . ack 21 win 2814 > 00:31:56.735023 IP 127-0xxx.dk.ircd > > a91-153-5-49.elisa-laajakaista.fi.1465: . ack 21 win 2814 > 00:31:56.782449 IP 127-0xxx.dk.ssh > 221.10.254.205.50638: P 1:42(41) > ack 1 win 5792 <nop,nop,timestamp 116365432 508437179> > 00:31:56.782461 IP 127-0xxx.dk.ssh > 221.10.254.205.50638: P 1:42(41) > ack 1 win 5792 <nop,nop,timestamp 116365432 508437179> > 00:31:56.812521 IP ns1.xxx.bz.domain > dns1-khk.cybercity.dk.8141: > 29003* 1/2/0 A web01.mcn.dk (89) > 00:31:56.812627 IP ns1.xxx.bz.domain > dns1-khk.cybercity.dk.8141: > 29003* 1/2/0 A web01.mcn.dk (89) > 00:31:56.833381 IP web01.xxx.dk.www > > port438.ds1-khk.adsl.cybercity.dk.10356: S 4090883955:4090883955(0) ack > 1171249356 win 5840 <mss 1460,nop,nop,sackOK> > 00:31:56.833388 IP web01.xxx.dk.www > > port438.ds1-khk.adsl.cybercity.dk.10356: S 4090883955:4090883955(0) ack > 1171249356 win 5840 <mss 1460,nop,nop,sackOK> > 00:31:56.846862 IP port438.ds1-khk.adsl.cybercity.dk.10356 > > web01.xxx.dk.www: . ack 1 win 65535 > 00:31:56.858354 IP port438.ds1-khk.adsl.cybercity.dk.10356 > > web01.xxx.dk.www: P 1:394(393) ack 1 win 65535 > 00:31:56.859943 IP web01.xxx.dk.www > > port438.ds1-khk.adsl.cybercity.dk.10356: . ack 394 win 6432 > 00:31:56.859951 IP web01.xxx.dk.www > > port438.ds1-khk.adsl.cybercity.dk.10356: . ack 394 win 6432 > ======= > > As you can see... some of the entries (not all of them) are doubled. > Any ideeas? > > [ ... ] _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
