Subject: Problems with Netramet 4.3 on Linux

From: Ralph Angenendt <[email-masked]>
Date: Thu, 20 Jan 2000 16:42:25 +0100

Hi,

we seem to have a weird problem with Netramet 4.3 running on Linux.
From time to time accounting for one IP-adress (a customer of ours
connected via isdn) in our Network gives totally strange figures,
sometimes > 10MB in a 2 minute interval - which isn't possible over
a 64Kbit-Line.

Here's our setup:

                                                customer
                                                  ____
					isdn	  |  |
                                        __________|  |
                                        |         |  |
                                        |         |  |
        ____                          __|__       ----
        |  |      eth                 |   |
NET ____|  |__________________________|   |
        |  | 			      |   |
        |  |			      |   |
        ----                          -----				
       router                        gateway
      (meter0)                       (meter1)

Now meter1 is measuring on eth0 (not on the isdn-interface - which
is raw-ip anyway, so there are no strange ppp-headers), packets from
other customers are also measured by this machine. Meter0 is
measuring the total packets which are leaving our networks to the
outside/are coming from the outside into our network. meter0 is
measuring on 3 ethernet-cards (another problem here - we have a
2Mbit card which contacts a Cisco via CHDLC - CHDLC's packet headers
can't be captured with Netramet).

Both meters are measuring these strange packets.

Here are some of those (62.96.219.163 is connected via isdn!):

#Time: 23:56:00 Wed 12 Jan 2000 62.96.219.2 Flows from 80714927 to
80726938
62.96.219.163 165.87.194.226 6 6 2635 25 80 10756728 693710
62.96.219.38 193.175.120.23 6 6 27694 25 80 2708 1119
62.96.219.38 132.187.12.84 6 6 27695 25 80 2717 1265
[...]
#Time: 23:58:00 Wed 12 Jan 2000 62.96.219.2 Flows from 80726937 to
80738948
62.96.219.163 165.87.194.226 6 6 2635 25 80 10758426 693818
62.96.219.237 193.0.14.129 17 17 53 53 76 130 276
62.96.219.38 62.144.210.23 6 6 27698 25 80 2711 979

All other measured traffic seems to be right (at least the amount of
traffic is believable).

Is this a known problem?

Ralph
-- 
__________________________________________________________________________
Ralph Angenendt       | "Military justice is to justice what military
http://www.letras.de  |  music is to music"
[email-masked]          |                -- Groucho Marx