Date: Wed, 30 Jun 2010 10:28:36 -0700 From: Mike Carlson <carlson39@llnl.gov> To: Alexander Sack <pisymbol@gmail.com> Cc: freebsd-net@freebsd.org Subject: Re: Intel 10Gb nic (ix driver) and bizarre netstat output Message-ID: <4C2B7EC4.2090005@llnl.gov> In-Reply-To: <AANLkTimuSqZRsbo_yd4iLdNk6xsgSDSwEtEJ46XP-krj@mail.gmail.com> References: <4C28CFBE.6050903@llnl.gov> <AANLkTimuSqZRsbo_yd4iLdNk6xsgSDSwEtEJ46XP-krj@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format.
--------------040203050901030107050900
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
On 06/30/2010 10:01 AM, Alexander Sack wrote:
> M
>
> On Mon, Jun 28, 2010 at 12:37 PM, Mike Carlson<carlson39@llnl.gov> wrote:
>
>> I've got a 10Gb intel nic on a FreeBSD 8.0-p3/AMD64 system, using the ix
>> driver:
>>
>> ix0:<Intel(R) PRO/10GbE PCI-Express Network Driver, Version - 1.8.9> port
>> 0xdce0-0xdcff mem 0xdf3a0000-0xdf3bffff,0xdf3c0000-
>> 0xdf3fffff,0xdf39c000-0xdf39ffff irq 35 at device 0.0 on pci5
>> ix0: Using MSIX interrupts with 17 vectors
>> ix0: [ITHREAD]
>> ...
>> ix0: Ethernet address: 00:1b:21:3f:b5:fc
>>
>> ix0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9194
>>
>> options=5bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,LRO>
>> ether 00:1b:21:3f:b5:fc
>> inet 192.168.6.56 netmask 0xffffff00 broadcast 192.168.6.255
>> media: Ethernet autoselect (10Gbase-LR<full-duplex>)
>> status: active
>>
>> What seems a bit odd is even when they system is 'idle', netstat reports a
>> burst of outgoing data at an unpredictable interval:
>> # netstat -I ix0 -w 1
>> input (ix0) output
>> packets errs bytes packets errs bytes colls
>> 1 0 496 1 0 18446744073709551436 0
>> 1 0 252 1 0 0 0
>> 28 0 19768 42 0 0 0
>> 2 0 316 1 0 0 0
>> 1 0 252 1 0 0 0
>>
>> That large "burst" becomes more frequent if there is a reasonable network
>> load on the server (like a NFS or Samba file transfer):
>> # netstat -I ix0 -w 1
>> input (ix0) output
>> packets errs bytes packets errs bytes colls
>> 1 0 496 1 0 18446744073709551436 0
>> 1652 0 1601979 2310 0 113716 0
>> 337 0 521230 397 0 18446744073709437900 0
>> 7562 0 276543 14580 0 21130649 0
>> 33784 0 90243561 65289 0 6398014 0
>> 34929 0 101041195 67431 0 18446744073708070746 0
>> 36180 0 102019403 70112 0 932461 0
>> 36337 0 104575965 70340 0 18446744073708694467 0
>> 35933 0 104627291 69241 0 18446744073707935998 0
>> 36498 0 104697232 70544 0 18446744073709094889 0
>> 36580 0 106044621 70737 0 18446744073708270130 0
>> 22934 0 80783509 44337 0 18446744073694340268 0
>> 11469 0 34850586 22131 0 18446744073707453470 0
>> 15661 0 40976798 30191 0 3816924 0
>> 14885 0 40763491 28572 0 1794493 0
>> 14554 0 47191162 28140 0 18446744073703905316 0
>> 16620 0 43843276 32154 0 3277056 0
>> 11800 0 38234856 22832 0 18446744073704976762 0
>> 14640 0 37771926 28340 0 3720383 0
>> 12230 0 37078829 23631 0 18446744073707401669 0
>>
>> Is this normal? Or, is there something strange about my network environment,
>> and if so, are there any suggestions to help me narrow down the issue?
>>
> Have you tried running tcpdump -i ix0 to see what the 42 packets were
> when its "idle?"
>
> -aps
>
>
I'm pretty sure that was ssh traffic, I don't have a serial or direct
console access so unfortunately I have to ssh in.
Attached is the output of netstat and 'tcpdump -i ix0'; I see what I
would consider 'normal' network traffic (ssh, syslog, and dns)...
Thanks for the reply!
Mike C
--------------040203050901030107050900
Content-Type: text/plain;
name="ix0-tcpdump.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="ix0-tcpdump.txt"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ix0, link-type EN10MB (Ethernet), capture size 96 bytes
10:19:48.070835 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 197801402, win 130, options [nop,nop,TS val 3976951004 ecr 137645182], length 192
10:19:48.071021 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 192, win 603, options [nop,nop,TS val 137645183 ecr 3976951004], length 0
10:19:48.150740 IP server-a.local.syslog > st-splunk.local.syslog: SYSLOG kernel.info, length: 56
10:19:48.908236 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1203398615, win 130, options [nop,nop,TS val 3563735615 ecr 137645166], length 112
10:19:48.908435 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 112, win 501, options [nop,nop,TS val 137645266 ecr 3563735615], length 0
10:19:49.071568 IP server-a.local.12553 > dns-a.local.domain: 4296+ PTR? 135.197.9.10.in-addr.arpa. (44)
10:19:49.072319 IP dns-a.local.domain > server-a.local.12553: 4296* 1/3/3 (184)
10:19:49.072427 IP server-a.local.28865 > dns-a.local.domain: 4297+ PTR? 56.6.115.192.in-addr.arpa. (43)
10:19:49.073102 IP dns-a.local.domain > server-a.local.28865: 4297* 1/3/3 (185)
10:19:49.073194 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976953009 ecr 137645183], length 208
10:19:49.073212 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976953009 ecr 137645183], length 192
10:19:49.073218 IP server-a.local.34630 > dns-a.local.domain: 4298+ PTR? 208.132.115.192.in-addr.arpa. (46)
10:19:49.073413 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 400, win 603, options [nop,nop,TS val 137645283 ecr 3976953009], length 0
10:19:49.073445 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 592, win 602, options [nop,nop,TS val 137645283 ecr 3976953009], length 0
10:19:49.073950 IP dns-a.local.domain > server-a.local.34630: 4298* 1/3/3 (190)
10:19:49.074015 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976953010 ecr 137645283], length 144
10:19:49.074042 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976953010 ecr 137645283], length 352
10:19:49.074186 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 736, win 603, options [nop,nop,TS val 137645283 ecr 3976953010], length 0
10:19:49.074230 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 1088, win 603, options [nop,nop,TS val 137645283 ecr 3976953010], length 0
10:19:49.208700 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8001.00:1e:7a:7b:5f:80.8002, length 43
10:19:49.908766 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563737616 ecr 137645266], length 112
10:19:49.908969 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 224, win 501, options [nop,nop,TS val 137645366 ecr 3563737616], length 0
10:19:50.074477 IP server-a.local.57614 > dns-a.local.domain: 4299+ PTR? 1.54.115.192.in-addr.arpa. (43)
10:19:50.075271 IP dns-a.local.domain > server-a.local.57614: 4299* 1/3/3 (177)
10:19:50.075356 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645283], length 160
10:19:50.075376 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645283], length 240
10:19:50.075399 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645283], length 432
10:19:50.075424 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645283], length 560
10:19:50.075552 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 1248, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0
10:19:50.075584 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 1488, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0
10:19:50.075617 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 1920, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0
10:19:50.075626 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645383], length 1152
10:19:50.075649 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 2480, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0
10:19:50.075861 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 3632, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0
10:19:50.376071 ARP, Request who-has client-bm1.local tell dsr01.192-115-6-254.local, length 46
10:19:50.529226 ARP, Request who-has nde-jessie.local tell dsr01.192-115-6-254.local, length 46
10:19:50.740332 IP nde-hp4600.local.1230 > 255.255.255.255.ntp: NTPv3, Client, length 48
10:19:50.756626 ARP, Request who-has server-b.local tell dsr01.192-115-6-254.local, length 46
10:19:50.908290 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563739615 ecr 137645366], length 112
10:19:50.908483 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 336, win 501, options [nop,nop,TS val 137645466 ecr 3563739615], length 0
10:19:51.076239 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957014 ecr 137645383], length 240
10:19:51.076261 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957015 ecr 137645383], length 192
10:19:51.076280 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957015 ecr 137645383], length 656
10:19:51.076331 IP server-a.local.61895 > dns-a.local.domain: 4300+ PTR? 30.6.115.192.in-addr.arpa. (43)
10:19:51.076456 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 3872, win 603, options [nop,nop,TS val 137645483 ecr 3976957014], length 0
10:19:51.076488 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 4720, win 603, options [nop,nop,TS val 137645483 ecr 3976957015], length 0
10:19:51.076497 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957015 ecr 137645483], length 864
10:19:51.076716 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 5584, win 603, options [nop,nop,TS val 137645483 ecr 3976957015], length 0
10:19:51.076991 IP dns-a.local.domain > server-a.local.61895: 4300* 1/3/3 (191)
10:19:51.077064 IP server-a.local.45046 > dns-a.local.domain: 4301+ PTR? 254.6.115.192.in-addr.arpa. (44)
10:19:51.077727 IP dns-a.local.domain > server-a.local.45046: 4301* 1/3/3 (198)
10:19:51.077791 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957018 ecr 137645483], length 144
10:19:51.077818 IP server-a.local.27651 > dns-a.local.domain: 4302+ PTR? 50.6.115.192.in-addr.arpa. (43)
10:19:51.077972 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 5728, win 603, options [nop,nop,TS val 137645483 ecr 3976957018], length 0
10:19:51.078024 IP client-a.local.59985 > server-a.local.ssh: Flags [P.], ack 5728, win 603, options [nop,nop,TS val 137645483 ecr 3976957018], length 48
10:19:51.078033 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976957018 ecr 137645483], length 0
10:19:51.078606 IP dns-a.local.domain > server-a.local.27651: 4302* 1/3/3 (188)
10:19:51.078665 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957019 ecr 137645483], length 144
10:19:51.078693 IP server-a.local.34496 > dns-a.local.domain: 4303+ PTR? 255.255.255.255.in-addr.arpa. (46)
10:19:51.079484 IP dns-a.local.domain > server-a.local.34496: 4303* 0/1/0 (81)
10:19:51.079558 IP server-a.local.47414 > dns-a.local.domain: 4304+ PTR? 137.6.115.192.in-addr.arpa. (44)
10:19:51.080222 IP dns-a.local.domain > server-a.local.47414: 4304* 1/3/3 (189)
10:19:51.080285 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957023 ecr 137645483], length.192
10:19:51.080299 IP server-a.local.18748 > dns-a.local.domain: 4305+ PTR? 14.6.115.192.in-addr.arpa. (43)
10:19:51.080479 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 6000, win 603, options [nop,nop,TS val 137645484 ecr 3976957019], length 0
10:19:51.080952 IP dns-a.local.domain > server-a.local.18748: 4305* 1/3/3 (188)
10:19:51.081017 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957024 ecr 137645484], length 144
10:19:51.081032 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957024 ecr 137645484], length 192
10:19:51.081044 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957024 ecr 137645484], length 192
10:19:51.081237 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 6336, win 603, options [nop,nop,TS val 137645484 ecr 3976957024], length 0
10:19:51.120977 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 6528, win 603, options [nop,nop,TS val 137645488 ecr 3976957024], length 0
10:19:51.208962 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8001.00:1e:7a:7b:5f:80.8002, length 43
10:19:51.908848 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563741616 ecr 137645466], length 112
10:19:51.909044 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 448, win 501, options [nop,nop,TS val 137645566 ecr 3563741616], length 0
10:19:52.081817 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645488], length 192
10:19:52.081833 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645488], length 352
10:19:52.081849 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645488], length 464
10:19:52.081865 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645488], length 432
10:19:52.082037 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 7072, win 601, options [nop,nop,TS val 137645584 ecr 3976959026], length 0
10:19:52.082065 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 7968, win 600, options [nop,nop,TS val 137645584 ecr 3976959026], length 0
10:19:52.082071 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645584], length 1448
10:19:52.082322 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 9416, win 603, options [nop,nop,TS val 137645584 ecr 3976959026], length 0
10:19:52.082330 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976959027 ecr 137645584], length 1448
10:19:52.082334 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959027 ecr 137645584], length 992
10:19:52.082588 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 10864, win 603, options [nop,nop,TS val 137645584 ecr 3976959027], length 0
10:19:52.082620 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 11856, win 599, options [nop,nop,TS val 137645584 ecr 3976959027], length 0
10:19:52.908404 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563743615 ecr 137645566], length 112
10:19:52.908605 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 560, win 501, options [nop,nop,TS val 137645666 ecr 3563743615], length 0
10:19:53.082501 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976961027 ecr 137645584], length 192
10:19:53.082520 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976961027 ecr 137645584], length 192
10:19:53.082539 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976961027 ecr 137645584], length 656
10:19:53.082723 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 12048, win 603, options [nop,nop,TS val 137645684 ecr 3976961027], length 0
10:19:53.082755 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack.19296, win 597, options [nop,nop,TS val 137645684 ecr 3976961027], length 0
10:19:53.082765 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976961027 ecr 137645684], length 1376
10:19:53.083010 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 14272, win 603, options [nop,nop,TS val 137645684 ecr 3976961027], length 0
10:19:53.209170 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8001.00:1e:7a:7b:5f:80.8002, length 43
10:19:53.908921 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563745616 ecr 137645666], length 112
10:19:53.909122 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 672, win 501, options [nop,nop,TS val 137645766 ecr 3563745616], length 0
10:19:54.083274 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963028 ecr 137645684], length 192
10:19:54.083290 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963028 ecr 137645684], length 352
10:19:54.083307 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963028 ecr 137645684], length 352
10:19:54.083322 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963028 ecr 137645684], length 464
10:19:54.083477 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 14464, win 603, options [nop,nop,TS val 137645784 ecr 3976963028], length 0
10:19:54.083487 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963029 ecr 137645784], length 352
10:19:54.083510 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 15168, win 603, options [nop,nop,TS val 137645784 ecr 3976963028], length 0
10:19:54.083542 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 15632, win 600, options [nop,nop,TS val 137645784 ecr 3976963028], length 0
10:19:54.083672 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 15984, win 603, options [nop,nop,TS val 137645784 ecr 3976963029], length 0
10:19:54.908455 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563747615 ecr 137645766], length 112
10:19:54.908648 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 784, win 501, options [nop,nop,TS val 137645866 ecr 3563747615], length 0
10:19:55.083805 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976965029 ecr 137645784], length 192
10:19:55.083827 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976965029 ecr 137645784], length 352
10:19:55.083848 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976965029 ecr 137645784], length 512
10:19:55.084019 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 16176, win 603, options [nop,nop,TS val 137645884 ecr 3976965029], length 0
10:19:55.084050 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 17040, win 597, options [nop,nop,TS val 137645884 ecr 3976965029], length 0
10:19:55.084058 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976965030 ecr 137645884], length 864
10:19:55.084275 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 17904, win 603, options [nop,nop,TS val 137645884 ecr 3976965030], length 0
10:19:55.209409 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8001.00:1e:7a:7b:5f:80.8002, length 43
10:19:55.725648 IP server-a.local.39599 > dns-a.local.domain: 54266+ PTR? 30.47.115.192.in-addr.arpa. (44)
10:19:55.726563 IP dns-a.local.domain > server-a.local.39599: 54266* 1/3/3 (187)
10:19:55.726679 IP server-a.local.25462 > dns-a.local.domain: 54267+ A? client-c.local. (35)
10:19:55.727382 IP dns-a.local.domain > server-a.local.25462: 54267* 1/3/3 A.192.115.47.30 (163)
10:19:55.727427 IP server-a.local.65084 > dns-a.local.domain: 54268+ AAAA? client-c.local. (35)
10:19:55.728453 IP dns-a.local.domain > server-a.local.65084: 54268* 0/1/0 (87)
10:19:55.735204 IP server-a.local.37443 > dns-a.local.domain: 54269+ A? SERVER-A.local. (34)
10:19:55.735800 IP dns-a.local.domain > server-a.local.37443: 54269* 1/3/3 A.192.115.6.56 (162)
10:19:55.736691 IP server-a.local.18091 > dns-a.local.domain: 54270+ A? the-lab.local. (34)
10:19:55.737518 IP dns-a.local.domain > server-a.local.18091: 54270 3/3/3 A.192.115.3.5,[|domain]
10:19:55.737560 IP server-a.local.46829 > dns-a.local.domain: 54271+ AAAA? the-lab.local. (34)
10:19:55.739453 IP dns-a.local.domain > server-a.local.46829: 54271 0/1/0 (97)
10:19:55.739554 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [S], seq 3518086552, win 65535, options [mss 9154,nop,wscale 9,sackOK,TS val 988958817 ecr 0], length 0
10:19:55.739821 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [S.], seq 1510212780, ack 3518086553, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 58006692 ecr 988958817], length 0
10:19:55.739837 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 1, win 130, options [nop,nop,TS val 988958817 ecr 58006692], length 0
10:19:55.739856 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 1, win 130, options [nop,nop,TS val 988958817 ecr 58006692], length 31
10:19:55.740230 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 32, win 260, options [nop,nop,TS val 58006692 ecr 988958817], length 46
10:19:55.740242 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 47, win 130, options [nop,nop,TS val 988958818 ecr 58006692], length 0
10:19:55.740407 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 47, win 130, options [nop,nop,TS val 988958818 ecr 58006692], length 136
10:19:55.740922 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 168, win 259, options [nop,nop,TS val 58006692 ecr 988958818], length 1448
10:19:55.740934 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 1495, win 127, options [nop,nop,TS val 988958819 ecr 58006692], length 0
10:19:55.740952 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 168, win 259, options [nop,nop,TS val 58006692 ecr 988958818], length 1448
10:19:55.740960 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 2943, win 124, options [nop,nop,TS val 988958820 ecr 58006692], length 0
10:19:55.7.1929 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 168, win 259, options [nop,nop,TS val 58006692 ecr 988958820], length 1448
10:19:55.741299 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 4391, win 127, options [nop,nop,TS val 988958820 ecr 58006692], length 0
10:19:55.741322 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 168, win 259, options [nop,nop,TS val 58006692 ecr 988958820], length 1902
10:19:55.741331 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 6293, win 126, options [nop,nop,TS val 988958820 ecr 58006692], length 0
10:19:55.742175 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 6293, win 130, options [nop,nop,TS val 988958822 ecr 58006692], length 338
10:19:55.747240 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 506, win 258, options [nop,nop,TS val 58006692 ecr 988958822], length 59
10:19:55.747251 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 6352, win 129, options [nop,nop,TS val 988958832 ecr 58006692], length 0
10:19:55.747345 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 6352, win 130, options [nop,nop,TS val 988958832 ecr 58006692], length 170
10:19:55.748631 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 676, win 257, options [nop,nop,TS val 58006692 ecr 988958832], length 53
10:19:55.748642 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 6405, win 129, options [nop,nop,TS val 988958835 ecr 58006692], length 0
10:19:55.748697 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 6405, win 130, options [nop,nop,TS val 988958835 ecr 58006692], length 122
10:19:55.749040 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 798, win 257, options [nop,nop,TS val 58006692 ecr 988958835], length 789
10:19:55.749052 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7194, win.192, options [nop,nop,TS val 988958836 ecr 58006692], length 0
10:19:55.749143 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7194, win 130, options [nop,nop,TS val 988958836 ecr 58006692], length 266
10:19:55.749586 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 1064, win 256, options [nop,nop,TS val 58006692 ecr 988958836], length 149
10:19:55.749598 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7343, win 129, options [nop,nop,TS val 988958837 ecr 58006692], length 0
10:19:55.749813 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7343, win 130, options [nop,nop,TS val 988958837 ecr 58006692], length 778
10:19:55.750364 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 1842, win 260, options [nop,nop,TS val 58006692 ecr 988958837], length 149
10:19:55.750376 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7492, win 129, options [nop,nop,TS val 988958838 ecr 58006692], length 0
10:19:55.750483 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7492, win 130, options [nop,nop,TS val 988958839 ecr 58006692], length 298
10:19:55.750960 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 2140, win 259, options [nop,nop,TS val 58006692 ecr 988958839], length 149
10:19:55.750972 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7641, win 129, options [nop,nop,TS val 988958840 ecr 58006692], length 0
10:19:55.751642 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7641, win 130, options [nop,nop,TS val 988958841 ecr 58006692], length 778
10:19:55.752168 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 2918, win 255, options [nop,nop,TS val 58006692 ecr 988958841], length 149
10:19:55.752180 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7790, win 129, options [nop,nop,TS val 988958842 ecr 58006692], length 0
10:19:55.752278 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7790, win 130, options [nop,nop,TS val 988958842 ecr 58006692], length 298
10:19:55.752709 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 3216, win 254, options [nop,nop,TS val 58006692 ecr 988958842], length 149
10:19:55.752721 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7939, win 129, options [nop,nop,TS val 988958843 ecr 58006692], length 0
10:19:55.753063 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7939, win 130, options [nop,nop,TS val 988958844 ecr 58006692], length 778
10:19:55.753584 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 3994, win 260, options [nop,nop,TS val 58006692 ecr 988958844], length 149
10:19:55.753595 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 8088, win 129, options [nop,nop,TS val 988958845 ecr 58006692], length 0
10:19:55.753687 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 8088, win 130, options [nop,nop,TS val 988958845 ecr 58006692], length 298
10:19:55.754053 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 4292, win 259, options [nop,nop,TS val 58006692 ecr 988958845], length 149
10:19:55.754065 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 8237, win 129, options [nop,nop,TS val 988958846 ecr 58006692], length 0
10:19:55.754912 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 8237, win 130, options [nop,nop,TS val 988958847 ecr 58006692], length 778
10:19:55.755329 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 5070, win 255, options [nop,nop,TS val 58006692 ecr 988958847], length 149
10:19:55.755341 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 8386, win 129, options [nop,nop,TS val 988958848 ecr 58006692], length 0
10:19:55.755430 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 8386, win 130, options [nop,nop,TS val 988958848 ecr 58006692], length 298
10:19:55.755819 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 5368, win 254, options [nop,nop,TS val 58006692 ecr 988958848], length 149
10:19:55.755831 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 8535, win 129, options [nop,nop,TS val 988958849 ecr 58006692], length 0
10:19:55.760781 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [F.], seq 5368, ack 8535, win 130, options [nop,nop,TS val 988958859 ecr 58006692], length 0
10:19:55.761060 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 5369, win 254, options [nop,nop,TS val 58006694 ecr 988958859], length 0
10:19:55.761093 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [R.], seq 8535, ack 5369, win 0, length 0
10:19:55.909066 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563749616 ecr 137645866], length 112
10:19:55.909268 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 896, win 501, options [nop,nop,TS val 137645966 ecr 3563749616], length 0
10:19:56.084137 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645884], length 192
10:19:56.084154 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645884], length 512
10:19:56.084171 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645884], length 512
10:19:56.084264 IP server-a.local.52183 > dns-a.local.domain: 4306+ PTR? 5.3.115.192.in-addr.arpa. (42)
10:19:56.084354 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 18096, win 603, options [nop,nop,TS val 137645984 ecr 3976967030], length 0
10:19:56.084385 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 19120, win 599, options [nop,nop,TS val 137645984 ecr 3976967030], length 0
10:19:56.084393 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645984], length 1448
10:19:56.084398 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645984], length 152
10:19:56.084648 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 20568, win 603, options [nop,nop,TS val 137645984 ecr 3976967030], length 0
10:19:56.084678 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 20720, win 603, options [nop,nop,TS val 137645984 ecr 3976967030], length 0
10:19:56.085057 IP dns-a.local.domain > server-a.local.52183: 4306* 1/3/3 PTR[|domain]
10:19:56.085133 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 224
10:19:56.085160 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 416
10:19:56.085183 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 368
10:19:56.085211 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 704
10:19:56.085232 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 880
10:19:56.085249 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 544
10:19:56.085268 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 544
10:19:56.085285 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 544
10:19:56.085310 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 20944, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085366 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 21360, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085399 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 21728, win 601, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085406 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 1448
10:19:56.085432 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 22432, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085438 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 1448
10:19:56.085483 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 23312, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085489 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 1448
10:19:56.085520 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 24944, win 599, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085528 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 1448
10:19:56.085533 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967033 ecr 137645984], length 464
10:19:56.085657 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 26392, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085690 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 27840, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085739 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 29288, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.085800 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 31200, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0
10:19:56.468552 IP 192.168.2.1.netbios-ns > 192.168.2.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
10:19:56.641949 IP client-a.local.42207 > server-a.local.ssh: Flags [P.], ack 896, win 501, options [nop,nop,TS val 137646040 ecr 3563749616], length 48
10:19:56.641964 IP server-a.local.ssh > client-a.local.42207: Flags [.], ack 49, win 130, options [nop,nop,TS val 3563751081 ecr 137646040], length 0
10:19:56.642002 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3563751081 ecr 137646040], length 48
10:19:56.64.192 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3563751082 ecr 137646040], length 48
10:19:56.642174 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 944, win 501, options [nop,nop,TS val 137646040 ecr 3563751081], length 0
10:19:56.642228 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3563751082 ecr 137646040], length 48
10:19:56.642292 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 992, win 501, options [nop,nop,TS val 137646040 ecr 3563751082], length 0
10:19:56.642385 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 1040, win 501, options [nop,nop,TS val 137646040 ecr 3563751082], length 0
^C
228 packets captured
262 packets received by filter
0 packets dropped by kernel
--------------040203050901030107050900
Content-Type: text/plain;
name="netstat.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="netstat.txt"
# netstat -I ix0 -w 1
input (ix0) output
packets errs bytes packets errs bytes colls
2 0 768 1 0 18446744073709551240 0
5 0 616 5 0 376 0
4 0 906 5 0 160 0
9 0 1825 8 0 883 0
11 0 2550 7 0 1540 0
17 0 5198 18 0 1178 0
8 0 4917 8 0 1653 0
6 0 6488 5 0 18446744073709548506 0
6 0 3298 6 0 18446744073709550978 0
33 0 13661 45 0 8229 0
^C
--------------040203050901030107050900--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4C2B7EC4.2090005>