Hi Chris, On Sat, Mar 14, 2009 at 05:53:39PM +0000, Chris Wilson wrote:
> The local machine is connected to a gigabit switch on the LAN, but this > host is attached to another switch which is not gigabit, so that suggests > to me that the counter is invalid. I just checked on the switch, and the > port that this machine is attached to is currently running at 100mbps. > > It is possible that either the switch or my firewall/router/pmacct box is > going mental and repeating traffic. > > Perhaps the best thing to do is to recompile pmacct with 64-bit counters > to see if the issue goes away? Alternatively I planned to log all traffic > with tcpdump -w to create a pcap file that I could replay into pmacctd to > reproduce the problem if it happens again. Would that work? Does pmacctd > honour the timestamps in the pcap file while reading it? Any signs of massive packet drops on any port throughout your switches? I ask because the traffic reported might not have been actually delivered to the end host. Can you do a bit of profiling? Like: see what is the average traffic download/upload for the host X; also what is the average bytes per packet value. Then, when you see an huge downstream traffic rate, see what happens to the upstream. Do you see any correspondence with respect to the average values? Yes, enable 64-bit counters and see what happens. If you see in a single entry ~8GB of traffic, then everything was correct. Otherwise something must have been wrong on the pmacct side. Running tcpdump in parallel would be great for double-checking. And yes, pmacct honours timestamps within pcap trace files. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
