Insane inbound traffic graph?

Coder42 · Post by **Coder42** » Wed May 04, 2005 9:16 am

For some reason my inbound traffic is insanely high. The outbound seems to be just about right for my server.

I tried using a simple iptables logger/grapher and found that the total transfered in a 1 day span, was just around 550mb = 22mb per hour.

So why oh why does it say this crazy amount? Also i would expect the ratio to be mostly on the outbound as my server doesnt accept files from anyone - and im the only user. But there is a high amount of web traffic.

My graph is added to the eth0 interface, where i have an external WAN ip assigned. No local network other than 127.0.0.1

I did note that in the poller log 2 entries looked the same:

Code: Select all

Data Source: cupid - Traffic - EXTERNAL-IP/eth0  
RRD: /usr/share/cacti/site/rra/my_traffic_in_12.rrd  
Action: 0, OID: .1.3.6.1.2.1.2.2.1.16.2 (Host: localhost, Community: public)  
Data Source: cupid - Traffic - EXTERNAL-IP/eth0  
RRD: /usr/share/cacti/site/rra/my_traffic_in_12.rrd  
Action: 0, OID: .1.3.6.1.2.1.2.2.1.10.2 (Host: localhost, Community: public)

Only reason i wanted to use cacti was because of bandwidth graphs, so i hope i can get some help here

edit: oops, 1hour was supposed to be 1 day.

Post by **rony** » Wed May 04, 2005 9:19 am

Possible counter wrapping causing a large spike, but I see no spike.....

Can you query that interface with 64-bit counters?

Coder42 · Post by **Coder42** » Wed May 04, 2005 9:20 am

Well it is my snmpd server running on a debian linux box.

Coder42 · Post by **Coder42** » Wed May 04, 2005 9:32 am

Hmm i just checked and it doesnt seem to support 64bit.

How would switching to 64bit help in this case anyway?

fmangeant · Post by **fmangeant** » Wed May 04, 2005 9:36 am

Everything seems OK : you're graphing from 14:15 to 16:00, which is 105 minutes. Your values are :

- inbound : 101 ko/s = 6.071 ko/min = 637.497 ko on a 105 minutes range

- outbound : 7 ko/s = 454 ko/min = 47.754 ko on a 105 minutes range.

Coder42 · Post by **Coder42** » Wed May 04, 2005 9:43 am

Yes i realize that the values seems correct, but the data is wrong.

My server have a high upload vs download (server point of view), as in reallity im the only person uploading files to it (otherwise it acts purely as a webserver). so even if these numbers hat to be remotely true, they should be reversed.

However as i said i ran an iptables bandwidth analyser and came to the conclusion that i only used about 2mb per 5'th minute.

This equals just about those 550mb per day i wrote about. Here im getting about 400mb per hour??

fmangeant · Post by **fmangeant** » Wed May 04, 2005 9:52 am

Can you compare these 2 methods :

Code: Select all

# snmpwalk -v 1 -c public localhost .ifEntry.ifOutOctets.1
IF-MIB::ifOutOctets.1 = Counter32: 3661044285

# snmpwalk -v 1 -c public localhost .ifEntry.ifInOctets.1
IF-MIB::ifInOctets.1 = Counter32: 3985195682

assuming eth0 is your card #1, and

Code: Select all

 # ifconfig eth0 | grep "RX bytes"
          RX bytes:3985202645 (3800.5 Mb)  TX bytes:3661057417 (3491.4 Mb)

The values should be the same.

Coder42 · Post by **Coder42** » Wed May 04, 2005 9:58 am

Alright snmp walk:

IF-MIB::ifOutOctets.1 = Counter32: 106120112

IF-MIB::ifInOctets.1 = Counter32: 106120412

Ifconfig:

RX bytes:1130520010 (1.0 GiB) TX bytes:97937520 (93.4 MiB)

hmm those numbers look pretty weird to me..?

fmangeant · Post by **fmangeant** » Wed May 04, 2005 10:03 am

It seems that you're querying the loopback with snmpwalk (the values are almost identical). What do you get with :

Code: Select all

 $ snmpwalk -v 1 -c public localhost ifDescr
IF-MIB::ifDescr.1 = STRING: eth0
IF-MIB::ifDescr.2 = STRING: eth1
IF-MIB::ifDescr.3 = STRING: lo

Coder42 · Post by **Coder42** » Wed May 04, 2005 10:04 am

snmpwalk -v 1 -c public localhost ifDescr
IF-MIB::ifDescr.1 = STRING: lo
IF-MIB::ifDescr.2 = STRING: eth0
IF-MIB::ifDescr.3 = STRING: sit0

fmangeant · Post by **fmangeant** » Wed May 04, 2005 10:07 am

Coder42 wrote:snmpwalk -v 1 -c public localhost ifDescr
IF-MIB::ifDescr.1 = STRING: lo
IF-MIB::ifDescr.2 = STRING: eth0
IF-MIB::ifDescr.3 = STRING: sit0

OK, try to compare :

Code: Select all

# snmpwalk -v 1 -c public localhost .ifEntry.ifOutOctets.2
IF-MIB::ifOutOctets.1 = Counter32: 3661044285

# snmpwalk -v 1 -c public localhost .ifEntry.ifInOctets.2
IF-MIB::ifInOctets.1 = Counter32: 3985195682

and

Code: Select all

 # ifconfig eth0 | grep "RX bytes"
          RX bytes:3985202645 (3800.5 Mb)  TX bytes:3661057417 (3491.4 Mb)

Coder42 · Post by **Coder42** » Wed May 04, 2005 10:10 am

Alright, these seem to match up:

snmpwalk -v 1 -c public localhost .ifEntry.ifOutOctets.2
IF-MIB::ifOutOctets.2 = Counter32: 99490815

snmpwalk -v 1 -c public localhost .ifEntry.ifInOctets.2
IF-MIB::ifInOctets.2 = Counter32: 1195523013

ifconfig eth0 | grep "RX bytes"
RX bytes:1195524267 (1.1 GiB) TX bytes:99491795 (94.8 MiB)

fmangeant · Post by **fmangeant** » Wed May 04, 2005 10:19 am

Well, you really have high inbound value...

I guees running ntop or tcpdump will show you where this traffic comes from.

Regards,

Frédéric

Coder42 · Post by **Coder42** » Wed May 04, 2005 10:39 am

Ah it looks like it counts all sending information from the rest of the servers on XXX.XXX.0.0 network - promiscius mode?

There has got to be a way to disable this?

fmangeant · Post by **fmangeant** » Wed May 04, 2005 10:44 am

Is your server connected to a hub or a switch ?

Cacti

Insane inbound traffic graph?

Insane inbound traffic graph?

Who is online