[lug] Interface stats getting zeroed

[Lee Woodworth]

On 01/29/2015 03:16 PM, Quentin Hartman wrote:
> What sort of NIC is in there? It feels like some kind of bug in the driver.
> Those numbers should never reset unless you reboot, or stop the interface
> and unload and reload the kernel module.

$ lspci
02:00.0 Ethernet controller: Broadcom Corporation NetXtreme II
BCM5716 Gigabit Ethernet (rev 20)

$ ethtool -i net0
driver: bnx2
version: 2.2.5
firmware-version: 6.2.15 bc 5.2.3 NCSI 2.0.11
bus-info: 0000:02:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no

The only thing I find in the logs near the time I suspect the counters
reset is a forwarded icmp packet that was blocked:
	SRC=218.77.79.43 ... PROTO=ICMP TYPE=3 CODE=10
The route for the source goes through china telecom with a round
trip time of 234.975 ms. As far as I can tell there was no corresponding
outbound request to 218.77.79.43 that would be a reason for an
icmp packet.

I have added fw rules to block all packets to and from the 218 address
so I can see if there are ever any outbound packets to it.

> 
> On Thu, Jan 29, 2015 at 3:00 PM, Lee Woodworth <blug-mail at duboulder.com>
> wrote:
> 
>> On 01/29/2015 01:33 PM, Quentin Hartman wrote:
>>> The most likely explanation is a reboot. What's your uptime look like?
>>
>> $ uptime
>> 14:57:27 up 36 days
>>
>> The time is consistent with the last time the kernel was upgraded.
>> This is a physical host with is seeing ~8Mbytes of arp packets
>> every 6 hours.
>>
>>>
>>> On Thu, Jan 29, 2015 at 1:23 PM, Lee Woodworth <blug-mail at duboulder.com>
>>> wrote:
>>>
>>>> On 01/29/2015 06:12 AM, Stephen Queen wrote:
>>>>> Is the interface configured dynamically? Could it be caused by a lease
>>>>> renewal?
>>>>
>>>> All static addresses. This is in a co-location facility.
>>>>
>>>>>
>>>>> Steve
>>>>>
>>>>> On Thu, Jan 29, 2015 at 12:00 AM, Lee Woodworth <
>> blug-mail at duboulder.com
>>>>>
>>>>> wrote:
>>>>>
>>>>>> Hi All,
>>>>>> On a 3.17.7 kernel, the packet stats for only the
>>>>>> internet connected interface are intermittently
>>>>>> getting zeroed. This is well before a possible
>>>>>> 32-bit counter rollover:
>>>>>>
>>>>>> At 12:01PM:
>>>>>>
>>>>>> RX packets 3952530  bytes 298884644 (285.0 MiB)
>>>>>> RX errors 0  dropped 371  overruns 0  frame 0
>>>>>> TX packets 173181  bytes 106932789 (101.9 MiB)
>>>>>> TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>>>>>>
>>>>>> At 18:01PM:
>>>>>>
>>>>>> RX packets 38581  bytes 2532445 (2.4 MiB)
>>>>>> RX errors 0  dropped 371  overruns 0  frame 0
>>>>>> TX packets 843  bytes 345803 (337.6 KiB)
>>>>>> TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>>>>>>
>>>>>> I am not finding anything on the web that would explain
>>>>>> this. As far as I can tell remotely, the interface
>>>>>> is not being brought down and restarted.
>>>>>>
>>>>>> Anyone have an idea of what might be causing this?
>>>>>> Like is this the result of a known attack?
>>>>>>
>>>>>> _______________________________________________
>>>>>> Web Page:  http://lug.boulder.co.us
>>>>>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>>>>>> Join us on IRC: irc.hackingsociety.org port=6667
>>>> channel=#hackingsociety
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> Web Page:  http://lug.boulder.co.us
>>>>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>>>>> Join us on IRC: irc.hackingsociety.org port=6667
>> channel=#hackingsociety
>>>>>
>>>>
>>>> _______________________________________________
>>>> Web Page:  http://lug.boulder.co.us
>>>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>>>> Join us on IRC: irc.hackingsociety.org port=6667
>> channel=#hackingsociety
>>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Web Page:  http://lug.boulder.co.us
>>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>>> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>>>
>>
>> _______________________________________________
>> Web Page:  http://lug.boulder.co.us
>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>>
> 
> 
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>