New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
KVM: crazy high RX transfer shown by ifconfig
[root@xxx:~] uptime 16:01:23 up 6:24, 1 user, load average: 0.00, 0.00, 0.00 [root@xxx:~] ifconfig eth0 eth0 Link encap:Ethernet HWaddr 00:16:3c:8e:e3:63 inet addr:199.229.XXX.YYY Bcast:199.229.XXX.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:2795306 errors:0 dropped:0 overruns:0 frame:0 TX packets:32110 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1691037798 (1.5 GiB) TX bytes:2847221 (2.7 MiB)
The VPS is doing very little traffic. Actual RX traffic is approximately equal to the TX.
SolusVM transfer graph for the last 6 hours. Rates are bytes/sec:
Any idea what's causing the high values for RX counter?
Comments
1.5gb isnt that much...
Might be just a lot of broadcasts.
To figure out what is the traffic on the interface
tcpdump -i eth0 -n -c 500 not port 22
You miss the point... the 1.5gb didn't happen. It's something wierd with the traffic accounting.
The SolusVM graphs should not be depended upon, there pretty in-accurate.
There are oodles of connections to IPs that aren't mine, but are on the same 199.229.0.0 network. Presumably other VPSs on the same node.
@LV_Matt New system in 1.13 R4 works better.
This. From what I've read, been told and experienced, Solus graphs are not accurate.
I've had hosts where I knew I'd done close to a TB in outgoing alone and their graphs only showed 450GB.
I've had hosts where I knew I'd done close to a TB in outgoing alone and their graphs only showed 450GB.
It's irrelevant here...
No, not ramhost. Could the interface be in promiscuous mode and cause this?
It's called unknown unicast flooding. Someone is sending packets to these IPs / MAC address you are seeing on the tcpdump and the bridge on the host node doesn't know where these MAC addresses are (like because they haven't talked recently) so it has to broadcast these packets to all interfaces in the bridge. The effect can increase a lot if there are a lot of devices (MAC addresses) on the same lan.
Hmm... so there's nothing to do but just ignore it?
oh is this at BlueVM KVM in Atlanta @sleddog? I've noticed the same thing on my KVM.
Yup. To be fair, other than this issue the VPS is great. It's mostly a cosmetic issue that makes it impossible to monitor my own traffic usage.
so it would be around ~180Gb / month just for unicast flood? what a waste
sleddog - Well the good news is we don't suspend people (usually within reason) for going over simply because these logs can't be trusted. If you throw in a ticket we can take a look though.
Set your subnet mask to /32, or whatever you were assigned.
It isn't counted against my transfer quota in SolusVM, so it's not really an issue. Solus shows my current monthly transfer as ~ 40 MB, which I think is accurate.
Thanks, will open a ticket.
Anyone else having these issues on KVM send in a ticket and we'll look into it.
Also, @TheHackBox tells me that all of BlueVM's traffic is publicly broadcasted, as in, you can sniff all traffic on the node via wshark/tcpdump and the co.
You should really vlan those (Private vlaning costs nothing), or figure out a way to do isolation.
More like someone needs to filter broadcast as that seems to be the only thing openly getting through. Darn windows boxes.