Cacti

In case anybody experiences a problem like this. Did you install any packet sniffers? Like SNORT or tcpdump. Then it is probably those that are setting your eth0 device into promiscuous mode - and it cant even be seen on ifconfig. just do a dmesg | grep promiscuous to check for occurences. I had tcp...

Ok i now know that i is a router/switch for sure.

I've tried to setup my iptables firewall to only accept packets with my IP as destination + the different ports i use.

Still this have no affect on the data.

Is there no way to tell cacti to only count hits on your IP?

It is pretty funny since the outbound seems to be right, but the inbound sees all other connections.

Im running ntop and the list is filled with servers from the rest of the network.

Im not quite sure, i cant get hold of the network administrator.

However im almost certain that is is a switch, in the form of a router of course.

I just looked at my eth0 setup, and saw that the netmask is set to: 255.255.255.128 - i wonder if it will change anything to set it to 255?

Ah it looks like it counts all sending information from the rest of the servers on XXX.XXX.0.0 network - promiscius mode?

There has got to be a way to disable this?

Alright, these seem to match up: snmpwalk -v 1 -c public localhost .ifEntry.ifOutOctets.2 IF-MIB::ifOutOctets.2 = Counter32: 99490815 snmpwalk -v 1 -c public localhost .ifEntry.ifInOctets.2 IF-MIB::ifInOctets.2 = Counter32: 1195523013 ifconfig eth0 | grep "RX bytes" RX bytes:1195524267 (1....

snmpwalk -v 1 -c public localhost ifDescr
IF-MIB::ifDescr.1 = STRING: lo
IF-MIB::ifDescr.2 = STRING: eth0
IF-MIB::ifDescr.3 = STRING: sit0

Alright snmp walk:

IF-MIB::ifOutOctets.1 = Counter32: 106120112

IF-MIB::ifInOctets.1 = Counter32: 106120412


Ifconfig:

RX bytes:1130520010 (1.0 GiB) TX bytes:97937520 (93.4 MiB)



hmm those numbers look pretty weird to me..?

Yes i realize that the values seems correct, but the data is wrong. My server have a high upload vs download (server point of view), as in reallity im the only person uploading files to it (otherwise it acts purely as a webserver). so even if these numbers hat to be remotely true, they should be rev...

Hmm i just checked and it doesnt seem to support 64bit.

How would switching to 64bit help in this case anyway?

Well it is my snmpd server running on a debian linux box.

For some reason my inbound traffic is insanely high. The outbound seems to be just about right for my server. I tried using a simple iptables logger/grapher and found that the total transfered in a 1 day span, was just around 550mb = 22mb per hour. So why oh why does it say this crazy amount? Also i...