[lug] Interface stats getting zeroed

[Lee Woodworth]

On 01/29/2015 01:33 PM, Quentin Hartman wrote:
> The most likely explanation is a reboot. What's your uptime look like?

$ uptime
14:57:27 up 36 days

The time is consistent with the last time the kernel was upgraded.
This is a physical host with is seeing ~8Mbytes of arp packets
every 6 hours.

> 
> On Thu, Jan 29, 2015 at 1:23 PM, Lee Woodworth <blug-mail at duboulder.com>
> wrote:
> 
>> On 01/29/2015 06:12 AM, Stephen Queen wrote:
>>> Is the interface configured dynamically? Could it be caused by a lease
>>> renewal?
>>
>> All static addresses. This is in a co-location facility.
>>
>>>
>>> Steve
>>>
>>> On Thu, Jan 29, 2015 at 12:00 AM, Lee Woodworth <blug-mail at duboulder.com
>>>
>>> wrote:
>>>
>>>> Hi All,
>>>> On a 3.17.7 kernel, the packet stats for only the
>>>> internet connected interface are intermittently
>>>> getting zeroed. This is well before a possible
>>>> 32-bit counter rollover:
>>>>
>>>> At 12:01PM:
>>>>
>>>> RX packets 3952530  bytes 298884644 (285.0 MiB)
>>>> RX errors 0  dropped 371  overruns 0  frame 0
>>>> TX packets 173181  bytes 106932789 (101.9 MiB)
>>>> TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>>>>
>>>> At 18:01PM:
>>>>
>>>> RX packets 38581  bytes 2532445 (2.4 MiB)
>>>> RX errors 0  dropped 371  overruns 0  frame 0
>>>> TX packets 843  bytes 345803 (337.6 KiB)
>>>> TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>>>>
>>>> I am not finding anything on the web that would explain
>>>> this. As far as I can tell remotely, the interface
>>>> is not being brought down and restarted.
>>>>
>>>> Anyone have an idea of what might be causing this?
>>>> Like is this the result of a known attack?
>>>>
>>>> _______________________________________________
>>>> Web Page:  http://lug.boulder.co.us
>>>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>>>> Join us on IRC: irc.hackingsociety.org port=6667
>> channel=#hackingsociety
>>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Web Page:  http://lug.boulder.co.us
>>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>>> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>>>
>>
>> _______________________________________________
>> Web Page:  http://lug.boulder.co.us
>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>>
> 
> 
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>