Hi Randall, thanks for the explanations. I installed WireShark now and will start it to look at the strange traffic should it appear again... I'll then mail again, if appropriate... (The reports I've mailed here before were taken within a minute or so, about every 10 seconds by typing ifconfig. What I ment with "during 4 hrs" was that during that time I saw the activity, but I didn't capture the numbers anymore... However right now it's "RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)" on eth1 - as it should be.) Daniel On Tuesday 09 September 2008 17:16:12, Randall R Schulz wrote:
On Tuesday 09 September 2008 07:53, Daniel Bauer wrote:
...
Hi Randall,
All the received packets are being dropped. I'm far from an expert on these things,
I'm even more far from an expert, much much more more far far :-)
but this must mean either they're not for any IP on the receiving host or they're not for the MAC that received the packet (which would imply the adaptor is in promiscuous mode, I think).
Ehm, if you'd say, I'm in promiscuous mode, I'd understand what you mean, but what does that mean in regard to the adaptor? Is that bad?
Ordinarily, network adaptors don't present to the operating system / driver software any packets that do not bear the adaptor's only (unique throughout Earth) MAC address as the packet's destination address. However, many (most? all??) adaptors have a so-called "promiscuous" mode in which every packet they receive is presented to the driver software. This allows, e.g., network packet sniffers such as WireShark to monitor all link activity, not just that directed at the host on which the sniffer is running.
Running in promiscuous mode will force the main CPU to handle every packet traversing the link. If most of those packets are actually destined for your host, then it's no problem. If many are not, then it's wasted CPU time handling those packets to do nothing other than examine their destination MAC address and then ignore them.
It does seem odd to me that the transmitted byte count is going up while the transmitted packet count remains at zero.
Can you communicate on the link whose activity is shown in these reports?
I have no wireless here in Basel and all the others around here are encrypted, so i cannot say, if wireless actually would work. It shows other LANs right now and it worked in Spain, though.
So this is a wireless link? It wasn't clear to me from your post whether you were showin the wired or wireless link's stats. Perhaps these extraneous counts just reflect RFI or some wayward wireless traffic that reached your receiver.
I have the vague notion that wireless Ethernet's bandwidth comes from one of those unregulated blocks shared by bluetooth and other consumer wireless devices. If that's so, it could be that sort of electronics that are triggering these spurious counts.
Maybe it's receiving its own transmitted packets?
Also, the ratio between the dropped packet count and the transmitted byte count, while not fixed, might be asymptotic to a number in the low 30s or so, which might be some kind of clue.
Huuh - even after asking wikipedia I don't understand "asymptotic" etc.
Consider a ratio between two integers. Let's say I start out with the numerator 1 and the denominator 1,000. The ratio is 1:1,000. Now I increment each number, giving the ration 2:1,001. Keep doing that indefinitely and while the ratio will get as close as you like to 1.0, it will never reach that value. That ratio is asymptotic to 1.0.
It appeared to me that there might be an asymptotic ratio between the dropped inbound packet counts and the transmitted byte counts you reported and that that number might be something "magic" (a power of two or a power of two plus another smaller power of two, say 32 or 40), which suggests a runt packet of some sort.
However, that activity was during about 4 hours this morning and then it stopped. Now it's absolutely quiet on eth1...
I didn't realize that was such a long timespan. (In the future, it might be a good idea to include timestamps).
In this case, I'd definitely ignore it. This is the merest of trickles.
But if it happens once again, ist there a way to log what happens or to find out where the activity comes from?
Well, WireShark is the classic tool for learning everything there is to know about what's happening on your networks, but it's pretty complex and I've used it so little that I'm not the one to instruct you how to learn what you want to know.
There might be simpler tools, but as I've said, this isn't something I'm all that knowledgeable about. Maybe someone else can point to something more appropriate to diagnosing your symptoms.
Daniel
Randall Schulz -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org