| View previous topic :: View next topic |
| Author |
Message |
anonybosh
Guru
Joined: 20 Nov 2005
Posts: 324
|
 Posted: Sun Nov 20, 2005 2:13 am Post subject: Network device usage |
 |
|
I am kind of curious-- I noticed the other day when checking the output of ifconfig on my server that all the local network traffic was being routed through the eth1 interface. This seems rather odd (not problematic however) as I have 3 nics:
eth0 -- internet (with apache2, iptables and sshd listening)
eth1 -- LAN (with dnsmasq, cups, ntpd, and assorted game servers listening)
eth2 -- LAN (with apache2, sshd and samba listening)
Apache, openssh and samba are all set to 'bind-interface eth2' (of course in their own config syntax). The vast majority (roughly 66%) of the traffic on the lan is from samba and apache, yet only 702 bytes have been transmitted from eth2.
| Code: | # ifconfig
eth0 Link encap:Ethernet HWaddr **:**:**:**:**:**
inet addr:66.54.207.82 Bcast:66.54.207.82 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5263942 errors:472 dropped:0 overruns:0 frame:472
TX packets:1277640 errors:0 dropped:0 overruns:0 carrier:9
collisions:0 txqueuelen:1000
RX bytes:1059430217 (1010.3 Mb) TX bytes:150293469 (143.3 Mb)
Interrupt:16 Base address:0xfc40
eth1 Link encap:Ethernet HWaddr **:**:**:**:**:**
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3074117 errors:0 dropped:0 overruns:0 frame:0
TX packets:3627463 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1173866258 (1119.4 Mb) TX bytes:2948979995 (2812.3 Mb)
Interrupt:19 Base address:0xf480
eth2 Link encap:Ethernet HWaddr **:**:**:**:**:**
inet addr:192.168.0.2 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4485 errors:0 dropped:0 overruns:0 frame:0
TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:724280 (707.3 Kb) TX bytes:702 (702.0 b)
Interrupt:18 Base address:0x7ce0
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:55789 errors:0 dropped:0 overruns:0 frame:0
TX packets:55789 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:8715193 (8.3 Mb) TX bytes:8715193 (8.3 Mb)
# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
66.54.207.0 * 255.255.255.0 U 0 0 0 eth0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth1
192.168.0.0 * 255.255.255.0 U 0 0 0 eth2
loopback * 255.0.0.0 U 0 0 0 lo
default 66.54.207.254 0.0.0.0 UG 0 0 0 eth0 |
So the question is, is it only if the eth1 interface becomes saturated that eth2 will then be used? Is this normal? |
|
| Back to top |
|
 |
volumen1
Guru
Joined: 01 Mar 2003
Posts: 393
Location: Missoula, MT
|
| Posted: Tue Nov 22, 2005 5:14 am Post subject: |
|
|
I wonder if your samba/etc return traffic is preferring your first route back. I'm not sure how Linux deals with two routes of the same cost. I would expect it would be flipping back and forth. But, what you might do is run tcpdump, ethereal and/or trafshow to see what the actual traffic is on each interface. That might give you a clue as to what's going on there. You could also screw around with metrics if you were concerned about it? Although, I'm not sure how to do that on routes from directly connected interfaces.
_________________
I was born with a freakin' dice bag on my belt.
-- www.howsyournetwork.com |
|
| Back to top |
|
|
nephros
Advocate
Joined: 07 Feb 2003
Posts: 2139
Location: Graz, Austria (Europe - no kangaroos.)
|
| Posted: Tue Nov 22, 2005 2:27 pm Post subject: |
|
|
I am just guessing here, and am probably making fool of myself too.
IIRC the routing table is traversed "first match".
Since the traffic for target 192.168.0.0 is routed to eth1, this is where the majority of the packets go out.
The small amount of poackages seen at eth2 are either you own pings when testing it, or some packets arriving there to initiate TCP connections (SYN/ACK Packets), once it has been established the connection is routed through eth1 again.
As I said, pure guesswork, but you could verify my theory by switching the two routing entries around.
_________________
Please put [SOLVED] in your topic if you are a moron. |
|
| Back to top |
|
|
anonybosh
Guru
Joined: 20 Nov 2005
Posts: 324
|
| Posted: Wed Nov 23, 2005 12:08 am Post subject: |
|
|
I tried running tcpdump during a new samba connection:
| Code: | # tcpdump -i eth2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 68 bytes
16:58:18.164078 arp who-has 192.168.0.2 tell 192.168.0.101 |
The exactly same thing happened also when trying to ping 192.168.0.2; only one packet received on eth2.
I am assuming this arp packet is telling 192.168.0.101 to use 192.168.0.1 instead of .0.2?
BTW: Running tcpdump on eth1 reveals a constant stream of data, if that makes any difference. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
