From owner-freebsd-net@FreeBSD.ORG Wed Jun 30 17:28:39 2010 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 152FD106566B for ; Wed, 30 Jun 2010 17:28:39 +0000 (UTC) (envelope-from carlson39@llnl.gov) Received: from nspiron-1.llnl.gov (nspiron-1.llnl.gov [128.115.41.81]) by mx1.freebsd.org (Postfix) with ESMTP id ED59A8FC16 for ; Wed, 30 Jun 2010 17:28:38 +0000 (UTC) X-Attachments: ix0-tcpdump.txt, netstat.txt Received: from bagua.llnl.gov (HELO [134.9.197.135]) ([134.9.197.135]) by nspiron-1.llnl.gov with ESMTP; 30 Jun 2010 10:28:38 -0700 Message-ID: <4C2B7EC4.2090005@llnl.gov> Date: Wed, 30 Jun 2010 10:28:36 -0700 From: Mike Carlson User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.9) Gecko/20100423 Thunderbird/3.0.4 MIME-Version: 1.0 To: Alexander Sack References: <4C28CFBE.6050903@llnl.gov> In-Reply-To: Content-Type: multipart/mixed; boundary="------------040203050901030107050900" Cc: freebsd-net@freebsd.org Subject: Re: Intel 10Gb nic (ix driver) and bizarre netstat output X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Jun 2010 17:28:39 -0000 This is a multi-part message in MIME format. --------------040203050901030107050900 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit On 06/30/2010 10:01 AM, Alexander Sack wrote: > M > > On Mon, Jun 28, 2010 at 12:37 PM, Mike Carlson wrote: > >> I've got a 10Gb intel nic on a FreeBSD 8.0-p3/AMD64 system, using the ix >> driver: >> >> ix0: port >> 0xdce0-0xdcff mem 0xdf3a0000-0xdf3bffff,0xdf3c0000- >> 0xdf3fffff,0xdf39c000-0xdf39ffff irq 35 at device 0.0 on pci5 >> ix0: Using MSIX interrupts with 17 vectors >> ix0: [ITHREAD] >> ... >> ix0: Ethernet address: 00:1b:21:3f:b5:fc >> >> ix0: flags=8843 metric 0 mtu 9194 >> >> options=5bb >> ether 00:1b:21:3f:b5:fc >> inet 192.168.6.56 netmask 0xffffff00 broadcast 192.168.6.255 >> media: Ethernet autoselect (10Gbase-LR) >> status: active >> >> What seems a bit odd is even when they system is 'idle', netstat reports a >> burst of outgoing data at an unpredictable interval: >> # netstat -I ix0 -w 1 >> input (ix0) output >> packets errs bytes packets errs bytes colls >> 1 0 496 1 0 18446744073709551436 0 >> 1 0 252 1 0 0 0 >> 28 0 19768 42 0 0 0 >> 2 0 316 1 0 0 0 >> 1 0 252 1 0 0 0 >> >> That large "burst" becomes more frequent if there is a reasonable network >> load on the server (like a NFS or Samba file transfer): >> # netstat -I ix0 -w 1 >> input (ix0) output >> packets errs bytes packets errs bytes colls >> 1 0 496 1 0 18446744073709551436 0 >> 1652 0 1601979 2310 0 113716 0 >> 337 0 521230 397 0 18446744073709437900 0 >> 7562 0 276543 14580 0 21130649 0 >> 33784 0 90243561 65289 0 6398014 0 >> 34929 0 101041195 67431 0 18446744073708070746 0 >> 36180 0 102019403 70112 0 932461 0 >> 36337 0 104575965 70340 0 18446744073708694467 0 >> 35933 0 104627291 69241 0 18446744073707935998 0 >> 36498 0 104697232 70544 0 18446744073709094889 0 >> 36580 0 106044621 70737 0 18446744073708270130 0 >> 22934 0 80783509 44337 0 18446744073694340268 0 >> 11469 0 34850586 22131 0 18446744073707453470 0 >> 15661 0 40976798 30191 0 3816924 0 >> 14885 0 40763491 28572 0 1794493 0 >> 14554 0 47191162 28140 0 18446744073703905316 0 >> 16620 0 43843276 32154 0 3277056 0 >> 11800 0 38234856 22832 0 18446744073704976762 0 >> 14640 0 37771926 28340 0 3720383 0 >> 12230 0 37078829 23631 0 18446744073707401669 0 >> >> Is this normal? Or, is there something strange about my network environment, >> and if so, are there any suggestions to help me narrow down the issue? >> > Have you tried running tcpdump -i ix0 to see what the 42 packets were > when its "idle?" > > -aps > > I'm pretty sure that was ssh traffic, I don't have a serial or direct console access so unfortunately I have to ssh in. Attached is the output of netstat and 'tcpdump -i ix0'; I see what I would consider 'normal' network traffic (ssh, syslog, and dns)... Thanks for the reply! Mike C --------------040203050901030107050900 Content-Type: text/plain; name="ix0-tcpdump.txt" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="ix0-tcpdump.txt" tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ix0, link-type EN10MB (Ethernet), capture size 96 bytes 10:19:48.070835 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 197801402, win 130, options [nop,nop,TS val 3976951004 ecr 137645182], length 192 10:19:48.071021 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 192, win 603, options [nop,nop,TS val 137645183 ecr 3976951004], length 0 10:19:48.150740 IP server-a.local.syslog > st-splunk.local.syslog: SYSLOG kernel.info, length: 56 10:19:48.908236 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1203398615, win 130, options [nop,nop,TS val 3563735615 ecr 137645166], length 112 10:19:48.908435 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 112, win 501, options [nop,nop,TS val 137645266 ecr 3563735615], length 0 10:19:49.071568 IP server-a.local.12553 > dns-a.local.domain: 4296+ PTR? 135.197.9.10.in-addr.arpa. (44) 10:19:49.072319 IP dns-a.local.domain > server-a.local.12553: 4296* 1/3/3 (184) 10:19:49.072427 IP server-a.local.28865 > dns-a.local.domain: 4297+ PTR? 56.6.115.192.in-addr.arpa. (43) 10:19:49.073102 IP dns-a.local.domain > server-a.local.28865: 4297* 1/3/3 (185) 10:19:49.073194 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976953009 ecr 137645183], length 208 10:19:49.073212 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976953009 ecr 137645183], length 192 10:19:49.073218 IP server-a.local.34630 > dns-a.local.domain: 4298+ PTR? 208.132.115.192.in-addr.arpa. (46) 10:19:49.073413 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 400, win 603, options [nop,nop,TS val 137645283 ecr 3976953009], length 0 10:19:49.073445 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 592, win 602, options [nop,nop,TS val 137645283 ecr 3976953009], length 0 10:19:49.073950 IP dns-a.local.domain > server-a.local.34630: 4298* 1/3/3 (190) 10:19:49.074015 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976953010 ecr 137645283], length 144 10:19:49.074042 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976953010 ecr 137645283], length 352 10:19:49.074186 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 736, win 603, options [nop,nop,TS val 137645283 ecr 3976953010], length 0 10:19:49.074230 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 1088, win 603, options [nop,nop,TS val 137645283 ecr 3976953010], length 0 10:19:49.208700 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8001.00:1e:7a:7b:5f:80.8002, length 43 10:19:49.908766 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563737616 ecr 137645266], length 112 10:19:49.908969 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 224, win 501, options [nop,nop,TS val 137645366 ecr 3563737616], length 0 10:19:50.074477 IP server-a.local.57614 > dns-a.local.domain: 4299+ PTR? 1.54.115.192.in-addr.arpa. (43) 10:19:50.075271 IP dns-a.local.domain > server-a.local.57614: 4299* 1/3/3 (177) 10:19:50.075356 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645283], length 160 10:19:50.075376 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645283], length 240 10:19:50.075399 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645283], length 432 10:19:50.075424 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645283], length 560 10:19:50.075552 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 1248, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0 10:19:50.075584 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 1488, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0 10:19:50.075617 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 1920, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0 10:19:50.075626 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976955013 ecr 137645383], length 1152 10:19:50.075649 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 2480, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0 10:19:50.075861 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 3632, win 603, options [nop,nop,TS val 137645383 ecr 3976955013], length 0 10:19:50.376071 ARP, Request who-has client-bm1.local tell dsr01.192-115-6-254.local, length 46 10:19:50.529226 ARP, Request who-has nde-jessie.local tell dsr01.192-115-6-254.local, length 46 10:19:50.740332 IP nde-hp4600.local.1230 > 255.255.255.255.ntp: NTPv3, Client, length 48 10:19:50.756626 ARP, Request who-has server-b.local tell dsr01.192-115-6-254.local, length 46 10:19:50.908290 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563739615 ecr 137645366], length 112 10:19:50.908483 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 336, win 501, options [nop,nop,TS val 137645466 ecr 3563739615], length 0 10:19:51.076239 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957014 ecr 137645383], length 240 10:19:51.076261 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957015 ecr 137645383], length 192 10:19:51.076280 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957015 ecr 137645383], length 656 10:19:51.076331 IP server-a.local.61895 > dns-a.local.domain: 4300+ PTR? 30.6.115.192.in-addr.arpa. (43) 10:19:51.076456 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 3872, win 603, options [nop,nop,TS val 137645483 ecr 3976957014], length 0 10:19:51.076488 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 4720, win 603, options [nop,nop,TS val 137645483 ecr 3976957015], length 0 10:19:51.076497 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957015 ecr 137645483], length 864 10:19:51.076716 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 5584, win 603, options [nop,nop,TS val 137645483 ecr 3976957015], length 0 10:19:51.076991 IP dns-a.local.domain > server-a.local.61895: 4300* 1/3/3 (191) 10:19:51.077064 IP server-a.local.45046 > dns-a.local.domain: 4301+ PTR? 254.6.115.192.in-addr.arpa. (44) 10:19:51.077727 IP dns-a.local.domain > server-a.local.45046: 4301* 1/3/3 (198) 10:19:51.077791 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3976957018 ecr 137645483], length 144 10:19:51.077818 IP server-a.local.27651 > dns-a.local.domain: 4302+ PTR? 50.6.115.192.in-addr.arpa. (43) 10:19:51.077972 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 5728, win 603, options [nop,nop,TS val 137645483 ecr 3976957018], length 0 10:19:51.078024 IP client-a.local.59985 > server-a.local.ssh: Flags [P.], ack 5728, win 603, options [nop,nop,TS val 137645483 ecr 3976957018], length 48 10:19:51.078033 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976957018 ecr 137645483], length 0 10:19:51.078606 IP dns-a.local.domain > server-a.local.27651: 4302* 1/3/3 (188) 10:19:51.078665 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957019 ecr 137645483], length 144 10:19:51.078693 IP server-a.local.34496 > dns-a.local.domain: 4303+ PTR? 255.255.255.255.in-addr.arpa. (46) 10:19:51.079484 IP dns-a.local.domain > server-a.local.34496: 4303* 0/1/0 (81) 10:19:51.079558 IP server-a.local.47414 > dns-a.local.domain: 4304+ PTR? 137.6.115.192.in-addr.arpa. (44) 10:19:51.080222 IP dns-a.local.domain > server-a.local.47414: 4304* 1/3/3 (189) 10:19:51.080285 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957023 ecr 137645483], length.192 10:19:51.080299 IP server-a.local.18748 > dns-a.local.domain: 4305+ PTR? 14.6.115.192.in-addr.arpa. (43) 10:19:51.080479 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 6000, win 603, options [nop,nop,TS val 137645484 ecr 3976957019], length 0 10:19:51.080952 IP dns-a.local.domain > server-a.local.18748: 4305* 1/3/3 (188) 10:19:51.081017 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957024 ecr 137645484], length 144 10:19:51.081032 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957024 ecr 137645484], length 192 10:19:51.081044 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976957024 ecr 137645484], length 192 10:19:51.081237 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 6336, win 603, options [nop,nop,TS val 137645484 ecr 3976957024], length 0 10:19:51.120977 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 6528, win 603, options [nop,nop,TS val 137645488 ecr 3976957024], length 0 10:19:51.208962 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8001.00:1e:7a:7b:5f:80.8002, length 43 10:19:51.908848 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563741616 ecr 137645466], length 112 10:19:51.909044 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 448, win 501, options [nop,nop,TS val 137645566 ecr 3563741616], length 0 10:19:52.081817 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645488], length 192 10:19:52.081833 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645488], length 352 10:19:52.081849 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645488], length 464 10:19:52.081865 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645488], length 432 10:19:52.082037 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 7072, win 601, options [nop,nop,TS val 137645584 ecr 3976959026], length 0 10:19:52.082065 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 7968, win 600, options [nop,nop,TS val 137645584 ecr 3976959026], length 0 10:19:52.082071 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976959026 ecr 137645584], length 1448 10:19:52.082322 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 9416, win 603, options [nop,nop,TS val 137645584 ecr 3976959026], length 0 10:19:52.082330 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976959027 ecr 137645584], length 1448 10:19:52.082334 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976959027 ecr 137645584], length 992 10:19:52.082588 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 10864, win 603, options [nop,nop,TS val 137645584 ecr 3976959027], length 0 10:19:52.082620 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 11856, win 599, options [nop,nop,TS val 137645584 ecr 3976959027], length 0 10:19:52.908404 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563743615 ecr 137645566], length 112 10:19:52.908605 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 560, win 501, options [nop,nop,TS val 137645666 ecr 3563743615], length 0 10:19:53.082501 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976961027 ecr 137645584], length 192 10:19:53.082520 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976961027 ecr 137645584], length 192 10:19:53.082539 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976961027 ecr 137645584], length 656 10:19:53.082723 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 12048, win 603, options [nop,nop,TS val 137645684 ecr 3976961027], length 0 10:19:53.082755 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack.19296, win 597, options [nop,nop,TS val 137645684 ecr 3976961027], length 0 10:19:53.082765 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976961027 ecr 137645684], length 1376 10:19:53.083010 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 14272, win 603, options [nop,nop,TS val 137645684 ecr 3976961027], length 0 10:19:53.209170 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8001.00:1e:7a:7b:5f:80.8002, length 43 10:19:53.908921 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563745616 ecr 137645666], length 112 10:19:53.909122 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 672, win 501, options [nop,nop,TS val 137645766 ecr 3563745616], length 0 10:19:54.083274 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963028 ecr 137645684], length 192 10:19:54.083290 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963028 ecr 137645684], length 352 10:19:54.083307 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963028 ecr 137645684], length 352 10:19:54.083322 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963028 ecr 137645684], length 464 10:19:54.083477 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 14464, win 603, options [nop,nop,TS val 137645784 ecr 3976963028], length 0 10:19:54.083487 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976963029 ecr 137645784], length 352 10:19:54.083510 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 15168, win 603, options [nop,nop,TS val 137645784 ecr 3976963028], length 0 10:19:54.083542 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 15632, win 600, options [nop,nop,TS val 137645784 ecr 3976963028], length 0 10:19:54.083672 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 15984, win 603, options [nop,nop,TS val 137645784 ecr 3976963029], length 0 10:19:54.908455 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563747615 ecr 137645766], length 112 10:19:54.908648 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 784, win 501, options [nop,nop,TS val 137645866 ecr 3563747615], length 0 10:19:55.083805 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976965029 ecr 137645784], length 192 10:19:55.083827 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976965029 ecr 137645784], length 352 10:19:55.083848 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976965029 ecr 137645784], length 512 10:19:55.084019 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 16176, win 603, options [nop,nop,TS val 137645884 ecr 3976965029], length 0 10:19:55.084050 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 17040, win 597, options [nop,nop,TS val 137645884 ecr 3976965029], length 0 10:19:55.084058 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976965030 ecr 137645884], length 864 10:19:55.084275 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 17904, win 603, options [nop,nop,TS val 137645884 ecr 3976965030], length 0 10:19:55.209409 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8001.00:1e:7a:7b:5f:80.8002, length 43 10:19:55.725648 IP server-a.local.39599 > dns-a.local.domain: 54266+ PTR? 30.47.115.192.in-addr.arpa. (44) 10:19:55.726563 IP dns-a.local.domain > server-a.local.39599: 54266* 1/3/3 (187) 10:19:55.726679 IP server-a.local.25462 > dns-a.local.domain: 54267+ A? client-c.local. (35) 10:19:55.727382 IP dns-a.local.domain > server-a.local.25462: 54267* 1/3/3 A.192.115.47.30 (163) 10:19:55.727427 IP server-a.local.65084 > dns-a.local.domain: 54268+ AAAA? client-c.local. (35) 10:19:55.728453 IP dns-a.local.domain > server-a.local.65084: 54268* 0/1/0 (87) 10:19:55.735204 IP server-a.local.37443 > dns-a.local.domain: 54269+ A? SERVER-A.local. (34) 10:19:55.735800 IP dns-a.local.domain > server-a.local.37443: 54269* 1/3/3 A.192.115.6.56 (162) 10:19:55.736691 IP server-a.local.18091 > dns-a.local.domain: 54270+ A? the-lab.local. (34) 10:19:55.737518 IP dns-a.local.domain > server-a.local.18091: 54270 3/3/3 A.192.115.3.5,[|domain] 10:19:55.737560 IP server-a.local.46829 > dns-a.local.domain: 54271+ AAAA? the-lab.local. (34) 10:19:55.739453 IP dns-a.local.domain > server-a.local.46829: 54271 0/1/0 (97) 10:19:55.739554 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [S], seq 3518086552, win 65535, options [mss 9154,nop,wscale 9,sackOK,TS val 988958817 ecr 0], length 0 10:19:55.739821 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [S.], seq 1510212780, ack 3518086553, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 58006692 ecr 988958817], length 0 10:19:55.739837 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 1, win 130, options [nop,nop,TS val 988958817 ecr 58006692], length 0 10:19:55.739856 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 1, win 130, options [nop,nop,TS val 988958817 ecr 58006692], length 31 10:19:55.740230 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 32, win 260, options [nop,nop,TS val 58006692 ecr 988958817], length 46 10:19:55.740242 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 47, win 130, options [nop,nop,TS val 988958818 ecr 58006692], length 0 10:19:55.740407 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 47, win 130, options [nop,nop,TS val 988958818 ecr 58006692], length 136 10:19:55.740922 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 168, win 259, options [nop,nop,TS val 58006692 ecr 988958818], length 1448 10:19:55.740934 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 1495, win 127, options [nop,nop,TS val 988958819 ecr 58006692], length 0 10:19:55.740952 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 168, win 259, options [nop,nop,TS val 58006692 ecr 988958818], length 1448 10:19:55.740960 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 2943, win 124, options [nop,nop,TS val 988958820 ecr 58006692], length 0 10:19:55.7.1929 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 168, win 259, options [nop,nop,TS val 58006692 ecr 988958820], length 1448 10:19:55.741299 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 4391, win 127, options [nop,nop,TS val 988958820 ecr 58006692], length 0 10:19:55.741322 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 168, win 259, options [nop,nop,TS val 58006692 ecr 988958820], length 1902 10:19:55.741331 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 6293, win 126, options [nop,nop,TS val 988958820 ecr 58006692], length 0 10:19:55.742175 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 6293, win 130, options [nop,nop,TS val 988958822 ecr 58006692], length 338 10:19:55.747240 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 506, win 258, options [nop,nop,TS val 58006692 ecr 988958822], length 59 10:19:55.747251 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 6352, win 129, options [nop,nop,TS val 988958832 ecr 58006692], length 0 10:19:55.747345 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 6352, win 130, options [nop,nop,TS val 988958832 ecr 58006692], length 170 10:19:55.748631 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 676, win 257, options [nop,nop,TS val 58006692 ecr 988958832], length 53 10:19:55.748642 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 6405, win 129, options [nop,nop,TS val 988958835 ecr 58006692], length 0 10:19:55.748697 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 6405, win 130, options [nop,nop,TS val 988958835 ecr 58006692], length 122 10:19:55.749040 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 798, win 257, options [nop,nop,TS val 58006692 ecr 988958835], length 789 10:19:55.749052 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7194, win.192, options [nop,nop,TS val 988958836 ecr 58006692], length 0 10:19:55.749143 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7194, win 130, options [nop,nop,TS val 988958836 ecr 58006692], length 266 10:19:55.749586 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 1064, win 256, options [nop,nop,TS val 58006692 ecr 988958836], length 149 10:19:55.749598 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7343, win 129, options [nop,nop,TS val 988958837 ecr 58006692], length 0 10:19:55.749813 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7343, win 130, options [nop,nop,TS val 988958837 ecr 58006692], length 778 10:19:55.750364 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 1842, win 260, options [nop,nop,TS val 58006692 ecr 988958837], length 149 10:19:55.750376 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7492, win 129, options [nop,nop,TS val 988958838 ecr 58006692], length 0 10:19:55.750483 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7492, win 130, options [nop,nop,TS val 988958839 ecr 58006692], length 298 10:19:55.750960 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 2140, win 259, options [nop,nop,TS val 58006692 ecr 988958839], length 149 10:19:55.750972 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7641, win 129, options [nop,nop,TS val 988958840 ecr 58006692], length 0 10:19:55.751642 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7641, win 130, options [nop,nop,TS val 988958841 ecr 58006692], length 778 10:19:55.752168 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 2918, win 255, options [nop,nop,TS val 58006692 ecr 988958841], length 149 10:19:55.752180 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7790, win 129, options [nop,nop,TS val 988958842 ecr 58006692], length 0 10:19:55.752278 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7790, win 130, options [nop,nop,TS val 988958842 ecr 58006692], length 298 10:19:55.752709 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 3216, win 254, options [nop,nop,TS val 58006692 ecr 988958842], length 149 10:19:55.752721 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 7939, win 129, options [nop,nop,TS val 988958843 ecr 58006692], length 0 10:19:55.753063 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 7939, win 130, options [nop,nop,TS val 988958844 ecr 58006692], length 778 10:19:55.753584 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 3994, win 260, options [nop,nop,TS val 58006692 ecr 988958844], length 149 10:19:55.753595 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 8088, win 129, options [nop,nop,TS val 988958845 ecr 58006692], length 0 10:19:55.753687 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 8088, win 130, options [nop,nop,TS val 988958845 ecr 58006692], length 298 10:19:55.754053 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 4292, win 259, options [nop,nop,TS val 58006692 ecr 988958845], length 149 10:19:55.754065 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 8237, win 129, options [nop,nop,TS val 988958846 ecr 58006692], length 0 10:19:55.754912 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 8237, win 130, options [nop,nop,TS val 988958847 ecr 58006692], length 778 10:19:55.755329 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 5070, win 255, options [nop,nop,TS val 58006692 ecr 988958847], length 149 10:19:55.755341 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 8386, win 129, options [nop,nop,TS val 988958848 ecr 58006692], length 0 10:19:55.755430 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [P.], ack 8386, win 130, options [nop,nop,TS val 988958848 ecr 58006692], length 298 10:19:55.755819 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [P.], ack 5368, win 254, options [nop,nop,TS val 58006692 ecr 988958848], length 149 10:19:55.755831 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [.], ack 8535, win 129, options [nop,nop,TS val 988958849 ecr 58006692], length 0 10:19:55.760781 IP server-a.local.49251 > adinst-1.the-lab.local.3268: Flags [F.], seq 5368, ack 8535, win 130, options [nop,nop,TS val 988958859 ecr 58006692], length 0 10:19:55.761060 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [.], ack 5369, win 254, options [nop,nop,TS val 58006694 ecr 988958859], length 0 10:19:55.761093 IP adinst-1.the-lab.local.3268 > server-a.local.49251: Flags [R.], seq 8535, ack 5369, win 0, length 0 10:19:55.909066 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 1, win 130, options [nop,nop,TS val 3563749616 ecr 137645866], length 112 10:19:55.909268 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 896, win 501, options [nop,nop,TS val 137645966 ecr 3563749616], length 0 10:19:56.084137 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645884], length 192 10:19:56.084154 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645884], length 512 10:19:56.084171 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645884], length 512 10:19:56.084264 IP server-a.local.52183 > dns-a.local.domain: 4306+ PTR? 5.3.115.192.in-addr.arpa. (42) 10:19:56.084354 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 18096, win 603, options [nop,nop,TS val 137645984 ecr 3976967030], length 0 10:19:56.084385 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 19120, win 599, options [nop,nop,TS val 137645984 ecr 3976967030], length 0 10:19:56.084393 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645984], length 1448 10:19:56.084398 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967030 ecr 137645984], length 152 10:19:56.084648 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 20568, win 603, options [nop,nop,TS val 137645984 ecr 3976967030], length 0 10:19:56.084678 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 20720, win 603, options [nop,nop,TS val 137645984 ecr 3976967030], length 0 10:19:56.085057 IP dns-a.local.domain > server-a.local.52183: 4306* 1/3/3 PTR[|domain] 10:19:56.085133 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 224 10:19:56.085160 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 416 10:19:56.085183 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 368 10:19:56.085211 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 704 10:19:56.085232 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 880 10:19:56.085249 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 544 10:19:56.085268 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 544 10:19:56.085285 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 544 10:19:56.085310 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 20944, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085366 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 21360, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085399 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 21728, win 601, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085406 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 1448 10:19:56.085432 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 22432, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085438 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 1448 10:19:56.085483 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 23312, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085489 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 1448 10:19:56.085520 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 24944, win 599, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085528 IP server-a.local.ssh > client-a.local.59985: Flags [.], ack 49, win 130, options [nop,nop,TS val 3976967032 ecr 137645984], length 1448 10:19:56.085533 IP server-a.local.ssh > client-a.local.59985: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3976967033 ecr 137645984], length 464 10:19:56.085657 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 26392, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085690 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 27840, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085739 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 29288, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.085800 IP client-a.local.59985 > server-a.local.ssh: Flags [.], ack 31200, win 603, options [nop,nop,TS val 137645984 ecr 3976967032], length 0 10:19:56.468552 IP 192.168.2.1.netbios-ns > 192.168.2.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 10:19:56.641949 IP client-a.local.42207 > server-a.local.ssh: Flags [P.], ack 896, win 501, options [nop,nop,TS val 137646040 ecr 3563749616], length 48 10:19:56.641964 IP server-a.local.ssh > client-a.local.42207: Flags [.], ack 49, win 130, options [nop,nop,TS val 3563751081 ecr 137646040], length 0 10:19:56.642002 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3563751081 ecr 137646040], length 48 10:19:56.64.192 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3563751082 ecr 137646040], length 48 10:19:56.642174 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 944, win 501, options [nop,nop,TS val 137646040 ecr 3563751081], length 0 10:19:56.642228 IP server-a.local.ssh > client-a.local.42207: Flags [P.], ack 49, win 130, options [nop,nop,TS val 3563751082 ecr 137646040], length 48 10:19:56.642292 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 992, win 501, options [nop,nop,TS val 137646040 ecr 3563751082], length 0 10:19:56.642385 IP client-a.local.42207 > server-a.local.ssh: Flags [.], ack 1040, win 501, options [nop,nop,TS val 137646040 ecr 3563751082], length 0 ^C 228 packets captured 262 packets received by filter 0 packets dropped by kernel --------------040203050901030107050900 Content-Type: text/plain; name="netstat.txt" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="netstat.txt" # netstat -I ix0 -w 1 input (ix0) output packets errs bytes packets errs bytes colls 2 0 768 1 0 18446744073709551240 0 5 0 616 5 0 376 0 4 0 906 5 0 160 0 9 0 1825 8 0 883 0 11 0 2550 7 0 1540 0 17 0 5198 18 0 1178 0 8 0 4917 8 0 1653 0 6 0 6488 5 0 18446744073709548506 0 6 0 3298 6 0 18446744073709550978 0 33 0 13661 45 0 8229 0 ^C --------------040203050901030107050900--