Date: Wed, 25 Apr 2001 08:17:48 +1000 (EST) From: Rowan Crowe <rowan@sensation.net.au> To: freebsd-isp@freebsd.org Subject: Re: IPFW ? hacked? Message-ID: <Pine.BSF.4.21.0104250813200.24730-100000@velvet.sensation.net.au> In-Reply-To: <006301c0ccf5$4a5e4600$c800a8c0@aspenworks.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 24 Apr 2001, alex huppenthal wrote: > I setup a pipe - number 5, and set the bandwidth to 20Mbits. > > Interestingly, I see 205.149.189.91 as a destination IP address at port 5999 > collecting data from x.x.18.3 > > I don't know 205.149.189.91 or have any process running to that site. > However, the numbers are increasing. > > Anyone seen this behavior? > > 00005: 20.000 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail > mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 > BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte > Drp > 0 tcp x.x.18.3/1027 205.149.189.91/5999 76043 19344253 0 0 > 0 Yes. I experimented with 4.x dummynet shaping on a popular web site, and it seems the first IP:port to run through the pipe gets shown, as above, for the life of that pipe. The byte/packet count is NOT specific to that single IP:port, it's everything travelling through the pipe. I'm not sure why this display is considered useful (?). If you delete and redo the pipe you'll probably get a different IP showing, so I wouldn't be too concerned about it... do some local testing with known IPs if you want to follow it up further? Cheers. -- Rowan Crowe http://www.rowan.sensation.net.au/ Sensation Internet Services http://info.sensation.net.au/ Melbourne, Australia Phone: +61-3-9388-9260 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0104250813200.24730-100000>