Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In with OpenID
Advertise on LowEndTalk.com

In this Discussion

KVM: crazy high RX transfer shown by ifconfig

KVM: crazy high RX transfer shown by ifconfig

sleddogsleddog Member
edited October 2012 in Help
[root@xxx:~] uptime
 16:01:23 up  6:24,  1 user,  load average: 0.00, 0.00, 0.00
 
[root@xxx:~] ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:16:3c:8e:e3:63  
          inet addr:199.229.XXX.YYY  Bcast:199.229.XXX.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2795306 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32110 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1691037798 (1.5 GiB)  TX bytes:2847221 (2.7 MiB)

The VPS is doing very little traffic. Actual RX traffic is approximately equal to the TX.

SolusVM transfer graph for the last 6 hours. Rates are bytes/sec:

image

Any idea what's causing the high values for RX counter?

Comments

  • rds100rds100 Member
    edited October 2012

    Might be just a lot of broadcasts.

    To figure out what is the traffic on the interface tcpdump -i eth0 -n -c 500 not port 22

  • @joodle said: 1.5gb isnt that much...

    You miss the point... the 1.5gb didn't happen. It's something wierd with the traffic accounting.

  • Run vnstat in screen for a day to see if it picks up the same amount of traffic :)

    If so then run tcpdump to find out what traffic it is.

  • The SolusVM graphs should not be depended upon, there pretty in-accurate.

  • @Jack said: If so then run tcpdump to find out what traffic it is.

    There are oodles of connections to IPs that aren't mine, but are on the same 199.229.0.0 network. Presumably other VPSs on the same node.

  • @LV_Matt New system in 1.13 R4 works better.

    fileMEDIA - Dedify: German Private Cloud @ https://www.dedify.com - CloudStack+XenServer+SSD

  • @LV_Matt said: The SolusVM graphs should not be depended upon, there pretty in-accurate.

    This. From what I've read, been told and experienced, Solus graphs are not accurate. I've had hosts where I knew I'd done close to a TB in outgoing alone and their graphs only showed 450GB.

    SonicGlass 11 Locations- Amsterdam, Atlanta, Denver, Los Angeles, , Milan,
    SonicBoxes.com - VPS Tips, Tricks & Tutorials

  • JackJack Member
    edited October 2012

    @sleddog said: There are oodles of connections to IPs that aren't mine, but are on the same 199.229.0.0 network. Presumably other VPSs on the same node.

    This sounds familiar , It's not ramhost is it?

  • @nunim said: @LV_Matt said: The SolusVM graphs should not be depended upon, there pretty in-accurate.

    This. From what I've read, been told and experienced, Solus graphs are not accurate. I've had hosts where I knew I'd done close to a TB in outgoing alone and their graphs only showed 450GB.

    It's irrelevant here... :)

  • @Jack said: This sounds familiar , It's not ramhost is it?

    No, not ramhost. Could the interface be in promiscuous mode and cause this?

  • It's called unknown unicast flooding. Someone is sending packets to these IPs / MAC address you are seeing on the tcpdump and the bridge on the host node doesn't know where these MAC addresses are (like because they haven't talked recently) so it has to broadcast these packets to all interfaces in the bridge. The effect can increase a lot if there are a lot of devices (MAC addresses) on the same lan.

  • @rds100 said: It's called unknown unicast flooding.

    Hmm... so there's nothing to do but just ignore it?

  • TheHackBoxTheHackBox Member
    edited October 2012

    oh is this at BlueVM KVM in Atlanta @sleddog? I've noticed the same thing on my KVM.

    This signature is brought to you by the NSA. Spying on the entire world since 1952!

  • @TheHackBox said: oh is this at BlueVM KVM in Atlanta @sleddog? I've noticed the same thing on my KVM.

    Yup. To be fair, other than this issue the VPS is great. It's mostly a cosmetic issue that makes it impossible to monitor my own traffic usage.

  • NanoG6NanoG6 Member
    edited October 2012

    so it would be around ~180Gb / month just for unicast flood? what a waste

  • sleddog - Well the good news is we don't suspend people (usually within reason) for going over simply because these logs can't be trusted. If you throw in a ticket we can take a look though.

    BlueVM | Best VPS Deals [~] 1GBPS, RAID-10, OpenVZ/KVM, 8 amazing locations. [~]
  • @sleddog said: There are oodles of connections to IPs that aren't mine, but are on the same 199.229.0.0 network. Presumably other VPSs on the same node

    Set your subnet mask to /32, or whatever you were assigned.

    -- BOFH

  • @NanoG6 said: so it would be around ~180Gb / month just for unicast flood? what a waste

    It isn't counted against my transfer quota in SolusVM, so it's not really an issue. Solus shows my current monthly transfer as ~ 40 MB, which I think is accurate.

    @BlueVM said: sleddog - Well the good news is we don't suspend people (usually within reason) for going over simply because these logs can't be trusted. If you throw in a ticket we can take a look though.

    Thanks, will open a ticket.

  • Anyone else having these issues on KVM send in a ticket and we'll look into it.

    - Ishaq
  • Also, @TheHackBox tells me that all of BlueVM's traffic is publicly broadcasted, as in, you can sniff all traffic on the node via wshark/tcpdump and the co.

    You should really vlan those (Private vlaning costs nothing), or figure out a way to do isolation.

    -- BOFH

  • @Wintereise said: Also, @TheHackBox tells me that all of BlueVM's traffic is publicly broadcasted, as in, you can sniff all traffic on the node via wshark/tcpdump and the co.

    More like someone needs to filter broadcast as that seems to be the only thing openly getting through. Darn windows boxes.

    This signature is brought to you by the NSA. Spying on the entire world since 1952!

Sign In or Register to comment.