From owner-freebsd-questions@FreeBSD.ORG Wed Feb 11 07:27:13 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 723DB16A4CE for ; Wed, 11 Feb 2004 07:27:13 -0800 (PST) Received: from lark.auton.cs.cmu.edu (LARK.AUTON.CS.CMU.EDU [128.2.222.44]) by mx1.FreeBSD.org (Postfix) with SMTP id 3057043D1D for ; Wed, 11 Feb 2004 07:27:13 -0800 (PST) (envelope-from dpelleg@lark.auton.cs.cmu.edu) Sender: dpelleg@lark.auton.cs.cmu.edu To: Igor Zbirka References: <4F1A640C-5C9F-11D8-82C4-000393B355F2@icpe.pl> From: Dan Pelleg Date: 11 Feb 2004 10:26:35 -0500 In-Reply-To: <4F1A640C-5C9F-11D8-82C4-000393B355F2@icpe.pl> Message-ID: Lines: 36 User-Agent: Gnus/5.0808 (Gnus v5.8.8) XEmacs/21.1 (Cuyahoga Valley) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii cc: questions@FreeBSD.org Subject: Re: very long connection times X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Feb 2004 15:27:13 -0000 Igor Zbirka writes: > I would like to ask you for some advice. > I'm using free BSD server in my local network as a rooter. Connection to > internet is done over ISDN. > > > During last months our connection time became rapidly too big. There were > several connections over 12 hours and sometimes over the night I can see > that the modem is on for a long time. Even though it shouldn't. > > I would like to know if there is somewhere a log file, which would show me > from which computer was generated the request to connect to internet? If yes > where is it. > > > Sincerely yours > > Igor Zbirka You can run tcpdump on the interface to see all the traffic (if you're leaving it on and go away, make sure it stops after a while - the output can be huge). My guess is that one of the clients has a web browser open on a page that auto-refreshes, or maybe an IM client that keeps connecting out (to make sure firewall rules are kept alive). Check out ppp's packet filtering options - you probably want to play with the dial and alive filters. You can also try using ppp's "Filter" logging option to track this down. -- Dan Pelleg