Hello Cristian, so i am able to replicate it and it looks to be a bug with the ios version.
Let's say i have a nothing connected on the port Gi1/0/8, if i do that: Switch#sh interfaces gigabitEthernet 1/0/8 GigabitEthernet1/0/8 is administratively down, line protocol is down (disabled) Hardware is Gigabit Ethernet, address is dca5.f434.5508 (bia dca5.f434.5508) MTU 1500 bytes, BW 10000 Kbit/sec, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:07:35, output 00:07:05, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 484517 packets input, 59890752 bytes, 0 no buffer Received 266453 broadcasts (221983 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 221983 multicast, 0 pause input 0 input packets with dribble condition detected 618866 packets output, 72946865 bytes, 0 underruns 0 output errors, 0 collisions, 35 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out I have 59890752 bytes in and 72946865 bytes out. I plug a laptop on it, pf receive a accounting packet with in 0 and out 0 (normal). If i shutdown the port then pf receive a accounting packet with 59890752 (a little bit more) bytes in and 72946865 (a little bit more) bytes out. +----+---------------+----------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ | id | acctsessionid | username | nasipaddress | acctstatustype | timestamp | acctinputoctets | acctoutputoctets | acctsessiontime | acctuniqueid | +----+---------------+----------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ | 3 | 0000005C | host/inverse-8.inverse.inc | 172.20.135.77 | Start | 2017-11-15 16:19:21 | 0 | 0 | 0 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 | | 6 | 0000005C | host/inverse-8.inverse.inc | 172.20.135.77 | Stop | 2017-11-15 16:19:28 | 59665537 | 72749820 | 7 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 | | 9 | 0000005D | host/inverse-8.inverse.inc | 172.20.135.77 | Start | 2017-11-15 16:19:31 | 0 | 0 | 0 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 | | 12 | 0000005D | host/inverse-8.inverse.inc | 172.20.135.77 | Stop | 2017-11-15 16:36:05 | 59846611 | 72909854 | 994 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 | | 15 | 00000060 | host/inverse-8.inverse.inc | 172.20.135.77 | Start | 2017-11-15 16:36:26 | 0 | 0 | 0 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 | | 18 | 00000060 | host/inverse-8.inverse.inc | 172.20.135.77 | Stop | 2017-11-15 16:36:57 | 59869432 | 72929035 | 30 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 | | 21 | 00000061 | host/inverse-8.inverse.inc | 172.20.135.77 | Start | 2017-11-15 16:38:25 | 0 | 0 | 0 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 | | 24 | 00000061 | host/inverse-8.inverse.inc | 172.20.135.77 | Stop | 2017-11-15 16:38:56 | 59890752 | 72946865 | 31 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 | +----+---------------+----------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ So it looks that the in/out bytes are never reseted and the switch send the in/out bytes since the switch started. What i can recommend is there is a new ios version then upgrade, if it doesn't fix the issue then open a TAC with cisco. Regards Fabrice Le 2017-11-15 à 06:09, Cristian Mammoli via PacketFence-users a écrit : > Ok this my Notebook wifi adapter (E4:B3:18:2C:E0:C0) and 192.168.7.221 > is a Cisco WLC. No problem here, the accounting data looks ok: > > MariaDB [pf]> select * from radacct_log where > acctuniqueid="c16c078f963c875d37013c5cba979106"; > +--------+----------------------------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > | id | acctsessionid | username | > nasipaddress | acctstatustype | timestamp | acctinputoctets > | acctoutputoctets | acctsessiontime | acctuniqueid | > +--------+----------------------------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > | 145688 | 5a042efb/e4:b3:18:2c:e0:c0/7093 | APRA=5C=5Cc.mammoli | > 192.168.7.221 | Start | 2017-11-09 11:33:31 | 0 > | 0 | 0 | c16c078f963c875d37013c5cba979106 | > | 145705 | 5a042efb/e4:b3:18:2c:e0:c0/7093 | APRA=5C=5Cc.mammoli | > 192.168.7.221 | Interim-Update | 2017-11-09 11:35:03 | 5803 > | 8401 | 93 | c16c078f963c875d37013c5cba979106 | > | 145784 | 5a042efb/e4:b3:18:2c:e0:c0/7093 | APRA=5C=5Cc.mammoli | > 192.168.7.221 | Stop | 2017-11-09 11:40:29 | 223227 > | 44823 | 326 | c16c078f963c875d37013c5cba979106 | > | 183214 | 5a0aa387/e4:b3:18:2c:e0:c0/11165 | APRA=5C=5Cc.mammoli | > 192.168.7.221 | Start | 2017-11-14 09:04:24 | 0 > | 0 | 0 | c16c078f963c875d37013c5cba979106 | > | 183481 | 5a0aa387/e4:b3:18:2c:e0:c0/11165 | APRA=5C=5Cc.mammoli | > 192.168.7.221 | Stop | 2017-11-14 09:15:25 | 6705186 > | 63346445 | 661 | c16c078f963c875d37013c5cba979106 | > +--------+----------------------------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > 5 rows in set (0.00 sec) > > This is my ethernet Adapter (84:7B:EB:4A:52:05), here the traffic > looks "out of scale", the same happens for everyone on this switches. > > MariaDB [pf]> select * from radacct_log where > acctuniqueid="085b986ead6b7d9a6951d1486493d889"; > +--------+---------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > | id | acctsessionid | username | nasipaddress | > acctstatustype | timestamp | acctinputoctets | > acctoutputoctets | acctsessiontime | acctuniqueid | > +--------+---------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > | 143611 | 00001212 | APRA=5C=5Cc.mammoli | 192.168.16.43 | > Start | 2017-11-09 09:01:15 | 0 > | 0 | 0 | 085b986ead6b7d9a6951d1486493d889 | > | 143612 | 00001212 | APRA=5C=5Cc.mammoli | 192.168.16.43 | > Interim-Update | 2017-11-09 09:01:15 | 2512995005 | 2056003245 > | 0 | 085b986ead6b7d9a6951d1486493d889 | > | 143613 | 00001212 | APRA=5C=5Cc.mammoli | 192.168.16.43 | > Interim-Update | 2017-11-09 09:01:15 | 2512995005 | 2056003245 > | 0 | 085b986ead6b7d9a6951d1486493d889 | > | 144184 | 00001212 | APRA=5C=5Cc.mammoli | 192.168.16.43 | > Stop | 2017-11-09 09:32:36 | 6535801 | 64990835 > | 1881 | 085b986ead6b7d9a6951d1486493d889 | > | 144373 | 00001217 | APRA=5C=5Cc.mammoli | 192.168.16.43 | > Start | 2017-11-09 09:45:34 | 0 > | 0 | 0 | 085b986ead6b7d9a6951d1486493d889 | > | 146834 | 00001217 | APRA=5C=5Cc.mammoli | 192.168.16.43 | > Interim-Update | 2017-11-09 12:46:07 | 2543121066 | 2372276848 > | 0 | 085b986ead6b7d9a6951d1486493d889 | > | 149206 | 00001217 | APRA=5C=5Cc.mammoli | 192.168.16.43 | > Interim-Update | 2017-11-09 15:46:40 | 29469179 | 261831473 > | 0 | 085b986ead6b7d9a6951d1486493d889 | > | 149848 | 00001217 | APRA=5C=5Cc.mammoli | 192.168.16.43 | > Stop | 2017-11-09 16:40:12 | 7283459 | 86594327 > | 3212 | 085b986ead6b7d9a6951d1486493d889 | > +--------+---------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > 8 rows in set (0.00 sec) > > MariaDB [pf]> select * from radacct_log where > acctuniqueid="a707be366d38eae790c9baf62fb087df"; > +--------+---------------+-------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > | id | acctsessionid | username | nasipaddress | > acctstatustype | timestamp | acctinputoctets | > acctoutputoctets | acctsessiontime | acctuniqueid | > +--------+---------------+-------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > | 149849 | 00001222 | host/NB-MAMMOLI.apra.it | 192.168.16.43 | > Start | 2017-11-09 16:40:12 | 0 > | 0 | 0 | a707be366d38eae790c9baf62fb087df | > | 149855 | 00001222 | host/NB-MAMMOLI.apra.it | 192.168.16.43 | > Stop | 2017-11-09 16:40:22 | 2579924138 | 2720777597 > | 9 | a707be366d38eae790c9baf62fb087df | > +--------+---------------+-------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+ > > 2 rows in set (0.00 sec) > > MariaDB [pf]> > > ------------------------------------------------------------------------------ > > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > PacketFence-users mailing list > PacketFence-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/packetfence-users -- Fabrice Durand fdur...@inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org) ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ PacketFence-users mailing list PacketFence-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/packetfence-users
