[lug] Interface stats getting zeroed

[Lee Woodworth]

On 01/29/2015 06:12 AM, Stephen Queen wrote:
> Is the interface configured dynamically? Could it be caused by a lease
> renewal?

All static addresses. This is in a co-location facility.

> 
> Steve
> 
> On Thu, Jan 29, 2015 at 12:00 AM, Lee Woodworth <blug-mail at duboulder.com>
> wrote:
> 
>> Hi All,
>> On a 3.17.7 kernel, the packet stats for only the
>> internet connected interface are intermittently
>> getting zeroed. This is well before a possible
>> 32-bit counter rollover:
>>
>> At 12:01PM:
>>
>> RX packets 3952530  bytes 298884644 (285.0 MiB)
>> RX errors 0  dropped 371  overruns 0  frame 0
>> TX packets 173181  bytes 106932789 (101.9 MiB)
>> TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>>
>> At 18:01PM:
>>
>> RX packets 38581  bytes 2532445 (2.4 MiB)
>> RX errors 0  dropped 371  overruns 0  frame 0
>> TX packets 843  bytes 345803 (337.6 KiB)
>> TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>>
>> I am not finding anything on the web that would explain
>> this. As far as I can tell remotely, the interface
>> is not being brought down and restarted.
>>
>> Anyone have an idea of what might be causing this?
>> Like is this the result of a known attack?
>>
>> _______________________________________________
>> Web Page:  http://lug.boulder.co.us
>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>>
> 
> 
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>