Thank you very much Fabrice, greatly appreciated. I'll schedule an
upgrade on a test switch.
Maybe the bug is related to this:
https://quickview.cloudapps.cisco.com/quickview/bug/CSCve85309 ?
Il 15/11/2017 22:50, Fabrice Durand via PacketFence-users ha scritto:
Hello Cristian,
so i am able to replicate it and it looks to be a bug with the ios version.
Let's say i have a nothing connected on the port Gi1/0/8, if i do that:
Switch#sh interfaces gigabitEthernet 1/0/8
GigabitEthernet1/0/8 is administratively down, line protocol is down
(disabled)
Hardware is Gigabit Ethernet, address is dca5.f434.5508 (bia
dca5.f434.5508)
MTU 1500 bytes, BW 10000 Kbit/sec, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:07:35, output 00:07:05, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
484517 packets input, 59890752 bytes, 0 no buffer
Received 266453 broadcasts (221983 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 221983 multicast, 0 pause input
0 input packets with dribble condition detected
618866 packets output, 72946865 bytes, 0 underruns
0 output errors, 0 collisions, 35 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
I have 59890752 bytes in and 72946865 bytes out.
I plug a laptop on it, pf receive a accounting packet with in 0 and out
0 (normal).
If i shutdown the port then pf receive a accounting packet with 59890752
(a little bit more) bytes in and 72946865 (a little bit more) bytes out.
+----+---------------+----------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
| id | acctsessionid | username | nasipaddress |
acctstatustype | timestamp | acctinputoctets |
acctoutputoctets | acctsessiontime | acctuniqueid |
+----+---------------+----------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
| 3 | 0000005C | host/inverse-8.inverse.inc | 172.20.135.77 |
Start | 2017-11-15 16:19:21 | 0 |
0 | 0 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 |
| 6 | 0000005C | host/inverse-8.inverse.inc | 172.20.135.77 |
Stop | 2017-11-15 16:19:28 | 59665537 |
72749820 | 7 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 |
| 9 | 0000005D | host/inverse-8.inverse.inc | 172.20.135.77 |
Start | 2017-11-15 16:19:31 | 0 |
0 | 0 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 |
| 12 | 0000005D | host/inverse-8.inverse.inc | 172.20.135.77 |
Stop | 2017-11-15 16:36:05 | 59846611 |
72909854 | 994 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 |
| 15 | 00000060 | host/inverse-8.inverse.inc | 172.20.135.77 |
Start | 2017-11-15 16:36:26 | 0 |
0 | 0 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 |
| 18 | 00000060 | host/inverse-8.inverse.inc | 172.20.135.77 |
Stop | 2017-11-15 16:36:57 | 59869432 |
72929035 | 30 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 |
| 21 | 00000061 | host/inverse-8.inverse.inc | 172.20.135.77 |
Start | 2017-11-15 16:38:25 | 0 |
0 | 0 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 |
| 24 | 00000061 | host/inverse-8.inverse.inc | 172.20.135.77 |
Stop | 2017-11-15 16:38:56 | 59890752 |
72946865 | 31 | 8cf6eb6093c8ef5f8f5b94ebe8e81265 |
+----+---------------+----------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
So it looks that the in/out bytes are never reseted and the switch send
the in/out bytes since the switch started.
What i can recommend is there is a new ios version then upgrade, if it
doesn't fix the issue then open a TAC with cisco.
Regards
Fabrice
Le 2017-11-15 à 06:09, Cristian Mammoli via PacketFence-users a écrit :
Ok this my Notebook wifi adapter (E4:B3:18:2C:E0:C0) and 192.168.7.221
is a Cisco WLC. No problem here, the accounting data looks ok:
MariaDB [pf]> select * from radacct_log where
acctuniqueid="c16c078f963c875d37013c5cba979106";
+--------+----------------------------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
| id | acctsessionid | username |
nasipaddress | acctstatustype | timestamp | acctinputoctets
| acctoutputoctets | acctsessiontime | acctuniqueid |
+--------+----------------------------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
| 145688 | 5a042efb/e4:b3:18:2c:e0:c0/7093 | APRA=5C=5Cc.mammoli |
192.168.7.221 | Start | 2017-11-09 11:33:31 | 0
| 0 | 0 | c16c078f963c875d37013c5cba979106 |
| 145705 | 5a042efb/e4:b3:18:2c:e0:c0/7093 | APRA=5C=5Cc.mammoli |
192.168.7.221 | Interim-Update | 2017-11-09 11:35:03 | 5803
| 8401 | 93 | c16c078f963c875d37013c5cba979106 |
| 145784 | 5a042efb/e4:b3:18:2c:e0:c0/7093 | APRA=5C=5Cc.mammoli |
192.168.7.221 | Stop | 2017-11-09 11:40:29 | 223227
| 44823 | 326 | c16c078f963c875d37013c5cba979106 |
| 183214 | 5a0aa387/e4:b3:18:2c:e0:c0/11165 | APRA=5C=5Cc.mammoli |
192.168.7.221 | Start | 2017-11-14 09:04:24 | 0
| 0 | 0 | c16c078f963c875d37013c5cba979106 |
| 183481 | 5a0aa387/e4:b3:18:2c:e0:c0/11165 | APRA=5C=5Cc.mammoli |
192.168.7.221 | Stop | 2017-11-14 09:15:25 | 6705186
| 63346445 | 661 | c16c078f963c875d37013c5cba979106 |
+--------+----------------------------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
5 rows in set (0.00 sec)
This is my ethernet Adapter (84:7B:EB:4A:52:05), here the traffic
looks "out of scale", the same happens for everyone on this switches.
MariaDB [pf]> select * from radacct_log where
acctuniqueid="085b986ead6b7d9a6951d1486493d889";
+--------+---------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
| id | acctsessionid | username | nasipaddress |
acctstatustype | timestamp | acctinputoctets |
acctoutputoctets | acctsessiontime | acctuniqueid |
+--------+---------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
| 143611 | 00001212 | APRA=5C=5Cc.mammoli | 192.168.16.43 |
Start | 2017-11-09 09:01:15 | 0
| 0 | 0 | 085b986ead6b7d9a6951d1486493d889 |
| 143612 | 00001212 | APRA=5C=5Cc.mammoli | 192.168.16.43 |
Interim-Update | 2017-11-09 09:01:15 | 2512995005 | 2056003245
| 0 | 085b986ead6b7d9a6951d1486493d889 |
| 143613 | 00001212 | APRA=5C=5Cc.mammoli | 192.168.16.43 |
Interim-Update | 2017-11-09 09:01:15 | 2512995005 | 2056003245
| 0 | 085b986ead6b7d9a6951d1486493d889 |
| 144184 | 00001212 | APRA=5C=5Cc.mammoli | 192.168.16.43 |
Stop | 2017-11-09 09:32:36 | 6535801 | 64990835
| 1881 | 085b986ead6b7d9a6951d1486493d889 |
| 144373 | 00001217 | APRA=5C=5Cc.mammoli | 192.168.16.43 |
Start | 2017-11-09 09:45:34 | 0
| 0 | 0 | 085b986ead6b7d9a6951d1486493d889 |
| 146834 | 00001217 | APRA=5C=5Cc.mammoli | 192.168.16.43 |
Interim-Update | 2017-11-09 12:46:07 | 2543121066 | 2372276848
| 0 | 085b986ead6b7d9a6951d1486493d889 |
| 149206 | 00001217 | APRA=5C=5Cc.mammoli | 192.168.16.43 |
Interim-Update | 2017-11-09 15:46:40 | 29469179 | 261831473
| 0 | 085b986ead6b7d9a6951d1486493d889 |
| 149848 | 00001217 | APRA=5C=5Cc.mammoli | 192.168.16.43 |
Stop | 2017-11-09 16:40:12 | 7283459 | 86594327
| 3212 | 085b986ead6b7d9a6951d1486493d889 |
+--------+---------------+---------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
8 rows in set (0.00 sec)
MariaDB [pf]> select * from radacct_log where
acctuniqueid="a707be366d38eae790c9baf62fb087df";
+--------+---------------+-------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
| id | acctsessionid | username | nasipaddress |
acctstatustype | timestamp | acctinputoctets |
acctoutputoctets | acctsessiontime | acctuniqueid |
+--------+---------------+-------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
| 149849 | 00001222 | host/NB-MAMMOLI.apra.it | 192.168.16.43 |
Start | 2017-11-09 16:40:12 | 0
| 0 | 0 | a707be366d38eae790c9baf62fb087df |
| 149855 | 00001222 | host/NB-MAMMOLI.apra.it | 192.168.16.43 |
Stop | 2017-11-09 16:40:22 | 2579924138 | 2720777597
| 9 | a707be366d38eae790c9baf62fb087df |
+--------+---------------+-------------------------+---------------+----------------+---------------------+-----------------+------------------+-----------------+----------------------------------+
2 rows in set (0.00 sec)
MariaDB [pf]>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
--
Mammoli Cristian
System administrator
T. +39 0731 22911
Via Brodolini 6 | 60035 Jesi (an)
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
