[lug] Interface stats getting zeroed

[Quentin Hartman]

What sort of NIC is in there? It feels like some kind of bug in the driver.
Those numbers should never reset unless you reboot, or stop the interface
and unload and reload the kernel module.

On Thu, Jan 29, 2015 at 3:00 PM, Lee Woodworth <blug-mail at duboulder.com>
wrote:

> On 01/29/2015 01:33 PM, Quentin Hartman wrote:
> > The most likely explanation is a reboot. What's your uptime look like?
>
> $ uptime
> 14:57:27 up 36 days
>
> The time is consistent with the last time the kernel was upgraded.
> This is a physical host with is seeing ~8Mbytes of arp packets
> every 6 hours.
>
> >
> > On Thu, Jan 29, 2015 at 1:23 PM, Lee Woodworth <blug-mail at duboulder.com>
> > wrote:
> >
> >> On 01/29/2015 06:12 AM, Stephen Queen wrote:
> >>> Is the interface configured dynamically? Could it be caused by a lease
> >>> renewal?
> >>
> >> All static addresses. This is in a co-location facility.
> >>
> >>>
> >>> Steve
> >>>
> >>> On Thu, Jan 29, 2015 at 12:00 AM, Lee Woodworth <
> blug-mail at duboulder.com
> >>>
> >>> wrote:
> >>>
> >>>> Hi All,
> >>>> On a 3.17.7 kernel, the packet stats for only the
> >>>> internet connected interface are intermittently
> >>>> getting zeroed. This is well before a possible
> >>>> 32-bit counter rollover:
> >>>>
> >>>> At 12:01PM:
> >>>>
> >>>> RX packets 3952530  bytes 298884644 (285.0 MiB)
> >>>> RX errors 0  dropped 371  overruns 0  frame 0
> >>>> TX packets 173181  bytes 106932789 (101.9 MiB)
> >>>> TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
> >>>>
> >>>> At 18:01PM:
> >>>>
> >>>> RX packets 38581  bytes 2532445 (2.4 MiB)
> >>>> RX errors 0  dropped 371  overruns 0  frame 0
> >>>> TX packets 843  bytes 345803 (337.6 KiB)
> >>>> TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
> >>>>
> >>>> I am not finding anything on the web that would explain
> >>>> this. As far as I can tell remotely, the interface
> >>>> is not being brought down and restarted.
> >>>>
> >>>> Anyone have an idea of what might be causing this?
> >>>> Like is this the result of a known attack?
> >>>>
> >>>> _______________________________________________
> >>>> Web Page:  http://lug.boulder.co.us
> >>>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> >>>> Join us on IRC: irc.hackingsociety.org port=6667
> >> channel=#hackingsociety
> >>>>
> >>>
> >>>
> >>>
> >>> _______________________________________________
> >>> Web Page:  http://lug.boulder.co.us
> >>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> >>> Join us on IRC: irc.hackingsociety.org port=6667
> channel=#hackingsociety
> >>>
> >>
> >> _______________________________________________
> >> Web Page:  http://lug.boulder.co.us
> >> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> >> Join us on IRC: irc.hackingsociety.org port=6667
> channel=#hackingsociety
> >>
> >
> >
> >
> > _______________________________________________
> > Web Page:  http://lug.boulder.co.us
> > Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> > Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
> >
>
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lug.boulder.co.us/pipermail/lug/attachments/20150129/22753035/attachment.html>